"The authentication feature could be bypassed as this vulnerability allows impersonation," Microsoft said in an advisory for the flaw last month.
CVE-2026-55040 and Microsoft's July 2026 patch
The flaw tracked as CVE-2026-55040 carries a CVSS score of 9.1 and was patched by Microsoft as part of its July 2026 Patch Tuesday updates. Microsoft described the issue as a critical security feature bypass that stems from weak authentication and warned that exploiting the vulnerability could allow an attacker to disclose files and modify data, although the attacker "cannot impact the availability of the system."
How Rapid7's proof-of-concept chains JWT validation weaknesses
Rapid7 has published a Python-based proof-of-concept (PoC) that demonstrates how an unauthenticated attacker can forge a valid JWT to impersonate any SharePoint site user. Rapid7 attributes the root cause to "several issues" in the JSON Web Token (JWT) validation pipeline and identifies two classes in SharePoint's token parsing and validation logic as implicated:
- SPJsonWebSecurityTokenHandlerV2
- SPJsonWebSecurityBaseTokenHandlerV2
The PoC chains four weaknesses to bypass authentication. In sequence, the exploitation technique described by Rapid7 and summarized by reporting is:
- An attacker sends a JWT with "alg: none" in the outer header so no signature is required in the outer token.
- The actor token's x5t header contains SharePoint's own Security Token Service (STS) certificate thumbprint, making it possible to resolve a signing key with no verification.
- The resolved certificate is not in TrustedSecurityTokenServices, yet the issuer is accepted.
- The actor token's signature is a non-empty value (for example, "AAAA") that is never verified.
Rapid7's PoC uses the forged JWT to query a target's domain controller, enumerate users by Security Identifier (SID), and auto-locate the SID for a site administrator — a sequence that could streamline privilege escalation to a site admin account on an unpatched SharePoint server.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePoC release and observed exploitation reported by Defused Cyber and KEVIntel
Following Rapid7's public PoC release, reporting from Defused Cyber indicates threat actors began leveraging the code in real-world activity. Telemetry captured by KEVIntel shows 12 exploitation attempts recorded since July 19, 2026; eight of those attempts occurred on August 12 and 13, 2026, suggesting the PoC release has played a role in recent activity.
KEVIntel attributes the 12 exploitation attempts to eight unique IP addresses across five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. As of the latest reporting, it remains unclear who is behind the exploitation activity or what their precise objectives are.
What this means for SharePoint administrators, security teams, and affected enterprises
SharePoint administrators and security teams should prioritize applying Microsoft's July 2026 Patch Tuesday fixes for CVE-2026-55040, as the public PoC has already been adopted by threat actors. The reporting explicitly advises keeping SharePoint instances up to date for optimal protection. Teams should also monitor logs for attempts consistent with the PoC's behavior — notably unexpected JWTs, authentication bypass attempts, queries to domain controllers originating from web-facing SharePoint endpoints, and SID enumeration activity aimed at locating site administrators.
Rapid7, Defused Cyber, and KEVIntel in the chain from disclosure to exploitation
Three named organizations appear at distinct points in the disclosure-to-exploitation lifecycle described in the reporting. Rapid7 published the PoC demonstrating the JWT validation chain that enables forgery and impersonation. Defused Cyber observed and reported that threat actors were leveraging the PoC in active operations. KEVIntel supplied telemetry quantifying exploitation attempts (12 attempts, eight clustered on August 12–13) and identifying the geographic diversity of IP origins. Together, those elements show the rapid movement from technical disclosure to observable hostile activity.
The documented sequence — a high-severity authentication bypass, an accessible PoC that forges JWTs, and immediate exploitation attempts across multiple countries — leaves one clear operational imperative: patch deployed SharePoint servers and hunt for indicators of the token-forging technique described by Rapid7. The facts reported so far confirm the vulnerability is fixed in July updates, the PoC is public, and exploitation attempts have already been observed; who is exploiting the flaw and to what end remains an open question.
