Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC Release

HomeCyber Attack News Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC Release By Guru Baran August 13, 2026 Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC Release Threat actors have wasted no time weaponizing a newly disclosed Microsoft SharePoint authentication bypass, launching real-world attacks against internet-facing servers just hours after security firm Rapid7 published a technical breakdown and proof-of-concept exploit for the flaw. The vulnerability, tracked as CVE-2026-55040 and carrying a critical CVSS score of 9.1, allows a remote, unauthenticated attacker to forge a valid authentication token and impersonate any SharePoint user, including a site administrator, without ever needing a password or session cookie. Threat intelligence firm Defused confirmed the exploitation trend after observing suspicious activity hitting its SharePoint honeypots, warning that attackers were “now using the @rapid7 POC for CVE-2026-55040” against exposed systems. Rapid7 security researcher Stephen Fewer published a detailed write-up and an accompanying Python-based exploit script, laying bare exactly how the flaw can be abused, and within a day, defenders were seeing the same code repurposed for live attacks. CVE-2026-55040 lives inside SharePoint’s JWT (JSON Web Token) validation pipeline, specifically in two internal classes called SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 that handle Bearer service-to-service token parsing. Rapid7 found that four separate weaknesses combine to break authentication entirely. How the Attack Works First, an attacker can send a token with its outer header set to “alg: none,” meaning no signature is required at all. Second, the token’s x5t header can be pointed at SharePoint’s own security token service certificate thumbprint, which is exposed on an unauthenticated metadata endpoint, letting the server resolve a signing key without real verification. Third, because that certificate isn’t listed in SharePoint’s TrustedSecurityTokenServices registry, the issuer gets accepted anyway. Finally, the signature field only needs to contain some non-empty value, such as a placeholder string, since the code never actually checks whether it’s cryptographically valid. Chained together, these gaps let an attacker submit a self-issued token naming any account, including a domain administrator, and have SharePoint accept it as legitimate. Rapid7’s PoC goes a step further by using the forged token to query a target’s domain controller, enumerate user accounts by SID, and automatically locate the site administrator account for full impersonation. Microsoft quietly fixed CVE-2026-55040 during its July 2026 Patch Tuesday rollout, describing it in its advisory as a weak authentication issue where “the authentication feature could be bypassed as this vulnerability allows impersonation.” The company noted that successful exploitation could let an attacker disclose files and modify data, though it would not affect system availability. The flaw affects on-premises deployments only: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Cloud-hosted SharePoint Online is not impacted. Despite the patch being available for roughly a month, security researchers warn that thousands of internet-facing SharePoint servers remain unpatched and exposed. Notably, CVE-2026-55040 is also the first link in a more dangerous chain: when combined with a separate remote code execution flaw, CVE-2026-63520, disclosed alongside Microsoft’s August Patch Tuesday, an unauthenticated attacker could escalate from impersonation to full code execution on a vulnerable server. Organizations running on-premises SharePoint should apply the July and August 2026 security updates immediately, restrict internet exposure of SharePoint servers, and monitor authentication logs for anomalous service-to-service token activity. Given the speed at which this PoC has already been weaponized, unpatched, publicly reachable SharePoint deployments should be treated as an active, urgent risk.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Tags cyber security news vulnerability Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Security News 40 Minute LiteLLM Hack Exposes Cloud Keys and CI/CD Secrets From 2,488 Companies Cyber Security News Wireshark 4.6.8 Released With Patch for 28 Vulnerabilities That Lead to Crashes AI Blacklight Toolkit Finds Codex, Claude Code, and Cursor Artifacts Exposing Tokens and Session Data Cyber Security News Phantom Stealer Hides Inside PNG Files, Then Steals Your Passwords, Cookies and Crypto Cyber Security News Trump Signs Memo Authorizing Private Firms for Cyber Operations Against Foreign Criminals Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?