Attackers Exploit SharePoint JWT Authentication Bypass After PoC Release
Active Exploitation · 5 sources · Updated 3mo ago · First seen Aug 13, 2026
Threat actors are actively exploiting CVE-2026-55040, a critical Microsoft SharePoint authentication bypass flaw with a CVSS score of 9.1, after public proof-of-concept code was released. The vulnerability, patched by Microsoft in July 2026, affects SharePoint Server Subscription Edition and allows unauthenticated attackers to forge JWTs, bypass authentication, and impersonate any SharePoint user, including administrators. Researchers said the bug chain stems from multiple weaknesses in SharePoint’s JWT validation pipeline, including acceptance of an outer token using alg: none and failures to properly verify certificate trust and token signatures.
Security researchers and honeypot operators reported a sharp rise in exploitation attempts immediately after the PoC became public, with telemetry showing 12 attempts since July 19 and most activity concentrated on August 12 and 13. Successful attacks can expose documents, enable data modification across a SharePoint farm, and provide a foothold for broader compromise of connected Microsoft 365 environments, increasing urgency for organizations to apply Microsoft’s patch and review SharePoint access for signs of abuse.
