SharePoint Subscription Edition

Attackers Actively Exploit Critical SharePoint Authentication Bypass CVE-2026-55040 After Public PoC Release

Active exploitation of CVE-2026-55040, a critical authentication bypass vulnerability in Microsoft SharePoint Server, has intensified following the public release of a proof-of-concept exploit. The flaw, which carries a CVSS score of 9.1, stems from multiple defects in the JWT token validation pipeline and allows remote attackers to impersonate any user, including administrators, without valid credentials. Affected versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, with heightened risk for instances exposed to the internet. Microsoft released patches in July 2026, and organizations are urged to apply them immediately while restricting external access and monitoring IIS logs for anomalous administrative activity. The vulnerability has already been chained with other flaws in real-world incidents involving persistence, data theft, and credential rotation responses.