Hackers mass attack Microsoft SharePoint servers after public PoC release

Kamy Le
5 days ago
2 min read

Shortly after proof-of-concept (PoC) tools were widely shared online, hacker groups quickly leveraged them to launch real-world attacks against Microsoft SharePoint servers. This vulnerability allows attackers to bypass login barriers to impersonate any user on the system without requiring a password.

Critical Authentication Bypass vulnerability on Microsoft SharePoint

The newly exploited vulnerability is tracked as CVE-2026-55040, reaching a very high severity level with a CVSS score of 9.1/10. This incident stems from weak identity verification mechanisms in SharePoint.

According to warnings from Microsoft, if successfully exploited, an attacker can spoof identities to gain access, view hidden files, or modify data on the system. However, this vulnerability does not affect the overall availability of the server.

Microsoft actually provided a fix for this issue in its July 2026 Patch Tuesday update. However, as observed by cybersecurity firm Defused Cyber, real-world attacks only surged after the company Rapid7 publicly disclosed PoC code demonstrating the exploitation method. The leak of the PoC code inadvertently acted as leverage for malicious actors to move faster.

How hackers exploit 4 weaknesses to impersonate users

Analysis from Rapid7 shows that the vulnerability stems from a chain of multiple flaws in SharePoint's JSON Web Token (JWT) verification process, specifically located in two logic processing components named SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.

Attackers can chain 4 consecutive weaknesses to bypass the system without an account:

Bypassing signatures: The attacker sends identity tokens configured with no encryption algorithm (alg: none), causing the system not to require signature checks on the outer token.
Tricking certificate recognition: Using SharePoint's own certificate information in the x5t header so the system automatically accepts the authentication key without suspicion.
Bypassing allowlists: Even if the certificate is not on the list of trusted services (TrustedSecurityTokenServices), the system still accepts the issuer.
Not verifying secondary signatures: Even when the signature carries a fake value (such as the string "AAAA"), the system ignores it and does not re-check it.

Thanks to this chain of flaws, a Python tool created by Rapid7 can easily query domain controllers, enumerate user lists, and automatically find site administrator accounts.

SharePoint continuously targeted in 2026

CVE-2026-55040 marks the fifth SharePoint vulnerability targeted and abused by malicious actors in real-world attacks since the beginning of the year, following four previous CVEs: CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

This situation demonstrates that the timeframe for attackers to transition from security research information to active real-world attacks is becoming increasingly short.

The incident surrounding CVE-2026-55040 on Microsoft SharePoint serves as yet another reminder to organizations of the importance of timely patching. As soon as PoC information is published, the safety window for systems shrinks rapidly against automated scanner activity from attackers.

Reference: The Hacker News