SharePoint Authentication Bypass Under Active Exploitation Days…

A critical vulnerability in Microsoft SharePoint's server-to-server authentication system, tracked as CVE-2026-55040 with a CVSS score of 9.1, is being actively exploited. Attackers began leveraging the flaw within days of Rapid7 publishing a detailed proof-of-concept exploit on August 10, 2026. At least 12 exploitation attempts from 8 unique IPs across five countries were detected, with a sharp spike on August 12–13. The vulnerability affects on-premises SharePoint Server Subscription Edition, 2019, and 2016; SharePoint Online is not affected. When chained with CVE-2026-63520, patched in August 2026, the flaw enables unauthenticated remote code execution.

{"main_topic":"cybersecurity","topics":["vulnerabilita","cve","exploit","microsoft","patch"]}

A critical vulnerability in Microsoft SharePoint's server-to-server (S2S) authentication system, identified as CVE-2026-55040 with a CVSS score of 9.1, has come under active exploitation just days after a proof-of-concept was made public. The flaw allows complete authentication bypass via a forged JWT token and has been exploited in at least 12 attempts detected from 8 unique IP addresses distributed across five countries, with a concentrated spike on August 12 and 13, 2026.

The implications extend beyond a single CVE: the interval between Rapid7's PoC publication and the first observed attacks is measured in hours, not weeks. This compression of time redefines the risk parameter for organizations still running unpatched on-premises deployments.

Key Takeaways

CVE-2026-55040 is an S2S authentication bypass vulnerability in SharePoint on-premises, rated CVSS 9.1 by the National Vulnerability Database.
Rapid7 published a detailed technical analysis with code decompilation and a Python PoC on August 10, 2026; within two days, 8 exploitation attempts were detected.
The attack chain exploits four concatenated weaknesses in JWT parsing: alg:none header, key resolution via exposed thumbprint, acceptance of an untrusted issuer, and an unvalidated signature placeholder.
Chaining with CVE-2026-63520, patched in August 2026, exposes unauthenticated remote code execution, according to NHS England Digital.

The Technical Mechanism: Four Errors Chaining a Total Bypass

Analysis by Stephen Fewer of Rapid7 identified the issue in the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes, components of the SharePoint identity framework responsible for validating Bearer tokens in server-to-server scenarios. Fewer decompiled the code in Microsoft.SharePoint.IdentityModel.dll, isolating a sequence of four weaknesses that turn a single implementation flaw into a complete authentication bypass.

The first link in the chain is the JWT alg:none header, which disables the digital signature requirement on the outer token. The second step exploits the x5t header to point to the thumbprint of a SharePoint STS certificate, retrievable from an unauthenticated endpoint. Third: the resolved certificate does not reside in the TrustedSecurityTokenServices registry, yet the server accepts it anyway. Fourth: the signature field contains a non-empty placeholder that is never actually validated. The result, as documented by Rapid7, is a token accepted as legitimate for any SharePoint identity, including the site collection administrator.

The PoC published by Rapid7 automates the entire flow: it generates a forged JWT, queries the domain controller to enumerate users by SID, and automatically locates the target site administrator's SID. This level of technical detail, made public on August 10, provided attackers with a reproducible blueprint requiring no independent reverse engineering.

From PoC to Exploitation: A 72-Hour Timeline

Data collected by KEVIntel, cited by The Hacker News, traces a timeline that leaves no ambiguity. The first 12 exploitation attempts were recorded starting July 19, 2026, but the temporal distribution reveals a sharp acceleration: 8 of the 12 attempts clustered on August 12 and 13, immediately following the Rapid7 PoC publication. The 8 source IPs were geolocated to Hong Kong, Japan, the Netherlands, Taiwan, and the United States.

Defused Cyber confirmed active exploitation by detecting attacks explicitly using the Rapid7 PoC against SharePoint honeypots configured for monitoring. The cross-confirmation between commercial intelligence and sensor detection confirms that weaponization occurred in an extremely compressed timeframe.

A limitation in the available data must be noted: sources document exploitation attempts, not confirmed successful compromises. The exact number of systems actually breached cannot be determined from the current dossier. Similarly, no infrastructure overlaps emerge linking the detected operators to a specific threat actor or identifiable motive.

Impact Perimeter: On-Premises, Not Cloud

The vulnerability exclusively affects on-premises installations of SharePoint Server: Subscription Edition, 2019, and Enterprise Server 2016. SharePoint Online is not affected, according to CyberSecurityNews. This distinction is significant because it concentrates risk on an installed base that typically maintains longer patching cycles than Microsoft-managed cloud infrastructure.

The on-premises nature of the target introduces an additional risk variable: the visibility of these systems to external actors depends on the internet exposure of SharePoint servers, often tied to incomplete reverse proxy or VPN configurations. CVE-2026-55040 is the fifth SharePoint vulnerability exploited in 2026, confirming a systemic pattern of offensive attention toward the platform.

The combination with CVE-2026-63520, patched in August 2026, raises the stakes. According to NHS England Digital, chaining the two flaws enables unauthenticated remote code execution. This RCE chain represents the maximum risk scenario for organizations that have not applied both fixes.

"A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator." — Stephen Fewer, Rapid7

Immediate Actions

Priority actions derive directly from documented guidance in primary sources and the CISA advisory. Applying the patch released by Microsoft in the July 2026 Patch Tuesday is the fundamental corrective measure for CVE-2026-55040; for organizations operating with extended change management cycles, the availability of the fix for CVE-2026-63520 in August 2026 demands a coordinated assessment to close both attack surfaces.

Rapid7's analysis suggests specifically verifying the presence of the vulnerable classes in on-premises SharePoint installations and checking the JWT S2S token validation pipeline configuration. CISA, in its SharePoint hardening advisory, indicated enabling AMSI detections as a complementary detection measure, though this tool does not constitute a substitute mitigation for patching.

Managing the perimeter exposure of SharePoint servers requires verifying unauthenticated access flows to endpoints that expose STS thumbprints or other identity configuration metadata. Finally, adopting a compressed patching window — orientatively under 72 hours for critical vulnerabilities with public PoC — appears consistent with the weaponization speed documented in this case.

Time Compression as a New Risk Variable

The CVE-2026-55040 case provides an empirical measure of a long-hypothesized phenomenon: the interval between technical disclosure and active exploitation has shrunk to a window incompatible with traditional patch management cycles. If the average enterprise patching delay exceeds 30 days, weaponization in hours or days creates an effective exposure window that standard processes cannot close.

The ability to generate working PoCs from decompilation analysis, as demonstrated by Rapid7, reflects a maturity level in offensive research that further accelerates the diffusion chain. For organizations with SharePoint on-premises, the question is no longer whether to apply the patch, but whether the change management process is structured to operate in a window under a week without compromising operational stability.

The outstanding question is the transition from attempts to actual compromises: until confirmations emerge of breached systems with measurable impacts, risk assessment remains conditioned on probability rather than certainty. But in this case, the probability is already high enough to make inaction a quantifiable choice.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references