VTA-000200 – SharePoint Authentication Bypass Vulnerability Under Active Exploitation

A critical security vulnerability in Microsoft SharePoint has been disclosed, allowing attackers to bypass authentication and perform arbitrary operations as a SharePoint site user or administrator. The vulnerability, identified as CVE-2026-55040, has a CVSS score of 9.1 and affects SharePoint servers. This vulnerability could allow an unauthenticated attacker to disclose files and modify data, although it does not impact the availability of the system. The vulnerability was patched by Microsoft as part of its July 2026 Patch Tuesday updates. However, threat actors have begun exploiting this vulnerability following the release of a proof-of-concept code.

The attack vector involves exploiting several issues in the JWT token validation pipeline, which allows an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. Specifically, the issue resides in two different classes that implement the token parsing and validation logic for Bearer service-to-service tokens. The exploitation chain can be triggered by sending a JWT with a specific header, allowing the attacker to resolve a signing key with no verification and accept the issuer without verification. A Python-based proof-of-concept exploit uses the forged JWT token to query a target's domain controller, enumerate users by SID, and auto-locate the SID for the user to find a site administrator.

The current exploitation status indicates that a total of 12 exploitation attempts has been recorded since July 19, 2026, with eight of these attempts occurring on August 12 and 13, 2026. This suggests that the release of the proof-of-concept code has played a role in the increased exploitation activity. SharePoint users are advised to keep their instances up to date for optimal protection. It is essential for organizations to prioritize patching this vulnerability to prevent potential attacks. The exploitation of this vulnerability could result in significant security breaches, emphasizing the need for prompt action.

Severity:

High

Attack Surface:

Content Management System, Web Application

Tactics:

Initial Access, Credential Access, Privilege Escalation

Techniques:

T1190 – Exploit Public-Facing Application

T1133 – External Remote Services

References:

1. https://github.com/sfewer-r7/CVE-2026-55040

2. https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html

3. https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/

SuperPRO’s Threat Countermeasures Procedures:

1. Apply the July 2026 Patch Tuesday updates to SharePoint servers to patch CVE-2026-55040

2. Ensure all SharePoint instances are up-to-date for optimal protection

3. Monitor for suspicious JWT token activity

4. Implement additional authentication measures, such as multi-factor authentication

5. Regularly review and update token validation logic

6. Disable unnecessary services and features on SharePoint servers

Contributed by: Lim Min Wei