Exploits Surge for Patched SharePoint Authentication Bypass

Attackers are actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint servers, with a surge in attempts following the public release of a proof-of-concept exploit. The vulnerability, tracked as CVE-2026-55040 and carrying a CVSS score of 9.1, was patched by Microsoft in its July 2026 security updates. However, exploitation attempts have increased significantly since security firm Rapid7 published a functional exploit script on August 12.

The flaw allows an unauthenticated attacker to bypass SharePoint's authentication mechanisms and impersonate any user or administrator on a site. According to Rapid7, the vulnerability stems from a chain of weaknesses in the SharePoint Server Subscription Edition's JSON Web Token validation pipeline. An attacker can exploit this by sending a forged token with a specific header, forcing the application to accept it as valid without proper verification. This grants the attacker full access to the compromised site.

Once inside, an attacker can read sensitive files, modify data across the SharePoint farm, and potentially use the foothold to access other corporate infrastructure. Microsoft's advisory confirms that...