Attackers Exploit Share Point Authentication Bypass After Public PoC Release
Summary: Attackers have begun exploiting CVE-2026-55040, a critical SharePoint authentication bypass with a CVSS score of 9.1 that Microsoft patched in its July 2026 Patch Tuesday updates, after Rapid7 released a proof-of-concept exploit earlier this week. The flaw chains four weaknesses in the JWT token validation pipeline to let an unauthenticated attacker forge a valid JWT and impersonate any SharePoint site user or administrator, and KEVIntel telemetry recorded 12 exploitation attempts since July 19, 2026, eight of them on August 12 and 13.
What's compelling: This is the fifth SharePoint vulnerability exploited this year, and the 12 attempts came from eight IP addresses across five countries and regions - Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. - with the concentration on August 12 and 13 showing how fast a public PoC converts into real attacks.