Threat actors have begun actively exploiting a critical Microsoft SharePoint authentication bypass vulnerability, following Rapid7’s publication of technical details and proof-of-concept (PoC) exploit code. Patched in Microsoft’s July 2026 Patch Tuesday updates, the flaw, tracked as CVE-2026-55040 (CVSS 9.1), stems from multiple weaknesses in the JWT token validation pipeline and allows an unauthenticated remote attacker to forge a valid JWT, impersonate a SharePoint site user or administrator, access sensitive files, and modify data. Rapid7 determined that the exploit chains four (4) validation weaknesses involving unsigned JWTs, SharePoint’s STS certificate thumbprint, inadequate issuer validation, and an actor-token signature that is never properly verified. Its Python-based PoC can also query a target’s domain controller, enumerate users by SID, and identify a site administrator for impersonation. Defused Cyber observed attackers using Rapid7’s PoC against SharePoint honeypots shortly after its release, while KEVIntel recorded twelve (12) exploitation attempts since July 19, 2026, including eight (8) on August 12 – 13, originating from eight (8) IP addresses across five (5) countries and regions, suggesting the public PoC accelerated exploitation. The actors and their objectives remain unknown, and Microsoft has not yet formally classified CVE-2026-55040 as exploited in the wild, despite labeling it an attractive target. With Shadowserver tracking more than 8,500 Internet-exposed SharePoint servers, The U.S. Cybersecurity and Infrastructure Security (CISA) has urged organizations to patch promptly, minimize direct Internet exposure, restrict external access to SharePoint Central Administration, and place necessary Internet-facing deployments behind Layer 7 security controls. The activity reflects a broader pattern of sustained targeting against Microsoft SharePoint. The flaw is reportedly the fifth SharePoint vulnerability exploited in 2026, while CISA has tracked fourteen (14) actively exploited SharePoint flaws since November 2021. Eight (8) of those vulnerabilities have also been linked to ransomware attacks, including CVE-2026-45659, which was recently confirmed to be exploited by ransomware threat actors.