Threat actors have begun to exploit a newly disclosed **Microsoft SharePoint** vulnerability following the release of a proof-of-concept (PoC) code. The vulnerability in question is **CVE-2026-55040** (CVSS score: 9.1), which refers to a critical security feature bypass stemming from weak authentication. It was patched by **Microsoft** as part of its July 2026 Patch Tuesday updates. "The authentication feature could be bypassed as this vulnerability allows impersonation," **Microsoft** stated in an advisory for the flaw last month. "Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system." Threat actors are leveraging a PoC exploit released by **Rapid7** earlier this week, once again indicating fresh flaws are being rapidly abused in real-world attacks. It's worth mentioning that **CVE-2026-55040** is the fifth **SharePoint** vulnerability to be exploited this year after **CVE-2026-45659**, **CVE-2026-56164**, **CVE-2026-58644**, and **CVE-2026-50522**. ## Technical Details of the Bypass Successful exploitation of **CVE-2026-55040** can allow an unauthenticated attacker to sidestep authentication on a vulnerable **SharePoint** server and perform arbitrary operations as a **SharePoint** site user or administrator. The vulnerability, per **Rapid7**, is due to "several issues" in the JWT token validation pipeline. Specifically, it chains four different weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any **SharePoint** site user. **Rapid7** said the issue resides in two different classes that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens: * **SPJsonWebSecurityTokenHandlerV2** * **SPJsonWebSecurityBaseTokenHandlerV2** The entire chain can be exploited by an attacker as follows: * Attacker sends a JWT with "alg: none" in the outer header, so no signature is required in the outer token. * The actor token's x5t header contains **SharePoint**'s own STS certificate thumbprint, making it possible to resolve a signing key with no verification. * The resolved certificate is not in **TrustedSecurityTokenServices**, allowing the issuer to be accepted. * The actor token's signature is a non-empty value, e.g., AAAA, which is never verified. **Rapid7**'s Python-based PoC uses the forged JWT token to query a target's domain controller, enumerate users by SID, and auto-locate the SID for the user to find a site administrator. ## Exploitation in the Wild As of writing, it's unclear who is behind the exploitation activity or what their end goals are. Telemetry data captured by **KEVIntel** shows that a total of 12 exploitation attempts were recorded since July 19, 2026. Out of these, eight took place on August 12 and 13, 2026, indicating that the release of the PoC has played a role in these efforts. The 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. In light of a spike in active exploitation, **SharePoint** users are advised to keep their instances up-to-date for optimal protection.