Attackers Actively Exploit Critical SharePoint Authentication Bypass CVE-2026-55040 After Public PoC Release

Attackers are actively exploiting CVE-2026-55040, a critical authentication bypass flaw in Microsoft SharePoint Server, following the publication of a public proof-of-concept exploit. The vulnerability, rated CVSS 9.1, enables remote unauthenticated access to SharePoint sites by bypassing security controls in the JWT token validation pipeline.

Once exploited, an attacker can impersonate any identity within the SharePoint environment, including users with full administrative privileges. This capability allows unauthorized configuration changes, content manipulation, and permission modifications that would normally require valid credentials.

The affected products encompass SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Risk is significantly elevated for on-premises deployments accessible from the internet, as the attack vector requires no prior authentication.

Security teams are advised to apply the July 2026 Microsoft security updates across all farm nodes and verify successful patching. Temporary mitigations include restricting external exposure and closely monitoring IIS logs and SharePoint telemetry for signs of impersonation or unusual administrative operations.

In documented incidents, post-compromise activities have included persistence mechanisms, theft of sensitive server data, and searches for cryptographic secrets. Some organizations have responded with credential rotation and, in severe cases, full server reinstallations to restore trust.