SharePoint Flaw Exploited After PoC Release

Cybercriminals have begun exploiting a critical Microsoft SharePoint vulnerability in the wild, just days after security firm Rapid7 published a proof-of-concept (PoC) exploit. The flaw, tracked as CVE-2026-55040, allows an unauthenticated attacker to impersonate any SharePoint user, and telemetry data suggests the public release of the PoC has directly fueled a spike in attack attempts.

Flaw Details and Severity

According to a report from The Hacker News, the vulnerability carries a CVSS score of 9.1 and stems from weak authentication in SharePoint's token validation pipeline. Microsoft's advisory, released last month, described the issue as a security feature bypass that could allow impersonation. "The authentication feature could be bypassed as this vulnerability allows impersonation," Microsoft said. "Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system."

The flaw resides in the JWT token validation logic, specifically in two classes: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2. Rapid7's analysis identified four chained weaknesses that, when combined, let a remote attacker forge a valid JWT and impersonate any SharePoint site user or administrator.

Exploitation Chain Unpacked

Rapid7 detailed the attack chain in its advisory. The process involves sending a JWT with an outer header specifying "alg: none", meaning no signature is required for the outer token. The actor token's x5t header contains SharePoint's own STS certificate thumbprint, allowing the attacker to resolve a signing key without verification. Since the resolved certificate is not in TrustedSecurityTokenServices, the issuer is accepted. Finally, the actor token's signature is a non-empty value like "AAAA", which is never actually verified.

Rapid7's Python-based PoC leverages this forged JWT to query a target's domain controller, enumerate users by Security Identifier (SID), and automatically locate the SID for a site administrator. The exploit effectively allows an unauthenticated attacker to perform arbitrary operations as a SharePoint site user or admin.

Attack Activity Since July 19

According to Defused Cyber, threat actors are now actively leveraging the PoC. Telemetry data captured by KEVIntel shows a total of 12 exploitation attempts have been recorded since July 19, 2026. Of these, eight occurred on August 12 and 13, 2026, indicating that the release of the PoC has played a role in these efforts.

The 12 attempts originated from eight unique IP addresses across five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. The geographic spread points to a distributed pattern of attacks, though the exact threat actor and their objectives remain unclear.

Patch Status and Mitigation

Microsoft patched CVE-2026-55040 as part of its July 2026 Patch Tuesday updates, so organizations that have applied the latest patches are protected. The company's advisory urged administrators to update their SharePoint instances to mitigate the risk. With active exploitation underway, keeping systems up-to-date is critical.

Implications for SharePoint Users

The rapid exploitation of this flaw underscores the urgency of patch management. Any organization running an unpatched SharePoint server is exposed to potential data disclosure or modification. Administrators should verify their patch status immediately and monitor for signs of unauthorized access. The fact that the PoC was released just before the uptick in attacks suggests that threat actors are closely monitoring security research and quickly integrating new exploits into their operations.