Threat actors have started exploiting a recently disclosed Microsoft SharePoint vulnerability following the publication of a proof-of-concept (PoC) code.

The vulnerability, identified as CVE-2026-55040 (CVSS score: 9.1), is a critical security feature bypass resulting from weak authentication. Microsoft addressed this issue in its July 2026 Patch Tuesday updates.

“The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft stated in an advisory last month. “Exploiting this vulnerability could lead to unauthorized access to files and data manipulation, but it does not impact system availability.”

Reports from Defused Cyber indicate that threat actors are exploiting a PoC exploit released by Rapid7, highlighting the swift exploitation of fresh vulnerabilities in real-world attacks.

It is noteworthy that CVE-2026-55040 marks the fifth SharePoint vulnerability exploited this year, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

Successful exploitation of CVE-2026-55040 enables an unauthenticated attacker to bypass authentication on a vulnerable SharePoint server and execute unauthorized operations as a SharePoint site user or administrator. According to Rapid7, the vulnerability arises from “several issues” in the JWT token validation process.

The exploit involves chaining four vulnerabilities to forge a valid JWT and impersonate a SharePoint site user:

  • SPJsonWebSecurityTokenHandlerV2

  • SPJsonWebSecurityBaseTokenHandlerV2

Rapid7’s Python-based PoC demonstrates the use of the forged JWT token to query a domain controller, enumerate users by SID, and identify a site administrator.

An analysis by KEVIntel revealed a total of 12 exploitation attempts since July 19, 2026, with eight occurring on August 12 and 13, 2026. The data indicates a surge in exploitation following the PoC release.

These exploitation attempts originated from eight unique IP addresses across five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. SharePoint users are advised to maintain up-to-date instances for enhanced security.