Following the release of a proof-of-concept (PoC) code, cybercriminals have started exploiting a recently revealed vulnerability in Microsoft SharePoint. Identified as CVE-2026-55040, this vulnerability has a CVSS score of 9.1, indicating its critical nature. Microsoft addressed this issue in its July 2026 Patch Tuesday release, highlighting the flaw as a weak authentication mechanism that can be bypassed, allowing attackers to impersonate users.
Details of the SharePoint Vulnerability
The vulnerability allows unauthorized access to SharePoint servers, enabling attackers to operate as legitimate users or administrators. Rapid7’s recent PoC disclosure has facilitated real-world attacks, as cybercriminals exploit fresh flaws. The vulnerability is attributed to deficiencies in the JWT token validation process, which integrates multiple weaknesses to craft a valid JWT and impersonate SharePoint users.
Understanding the Exploitation Technique
The exploitation chain involves four distinct weaknesses, particularly in the classes handling JWT token parsing and validation: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2. An attacker can manipulate the JWT with specific parameters, such as a misleading header and certificate thumbprint, to bypass authentication checks.
Rapid7’s Python-based PoC demonstrates how a forged JWT token can query a domain controller, identify users by SID, and locate site administrators. This method underscores the vulnerability’s severity, as attackers can conduct operations without detection.
Tracking Exploitation Attempts
Data from KEVIntel reveals 12 exploitation attempts since July 19, 2026, with a significant rise on August 12 and 13. These activities have been traced to eight distinct IP addresses across five regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. The surge in attacks coincides with the PoC release, emphasizing the need for vigilance.
As the perpetrators remain unidentified, it’s crucial for SharePoint users to ensure their systems are updated. Keeping software current is vital to mitigate risks posed by such vulnerabilities.
In conclusion, the exploitation of CVE-2026-55040 highlights the ongoing challenges in cybersecurity, particularly regarding newly discovered vulnerabilities. Organizations must prioritize timely updates and monitor system integrity to protect against potential threats.
