SharePoint auth bypass exploited in wild (CVE-2026-55040) [PoC]
CVE-2026-55040
CVE-2026-55040: Microsoft SharePoint auth bypass lets attackers bypass security features over a network, CVSS 9.1. CISA confirms active exploitation. Apply Microsoft's patch.
Actively exploited in the wild - CVE-2026-55040 is a critical authentication bypass in Microsoft Office SharePoint that lets unauthenticated attackers bypass security features over the network. Microsoft has released patches; apply them immediately.
Overview
CVE-2026-55040 is a critical vulnerability in Microsoft Office SharePoint’s authentication mechanism. The flaw, rated 9.1 on the CVSS scale, allows an attacker with no privileges and no user interaction to bypass security controls entirely over the network. The attack complexity is low, meaning exploitation does not require special conditions or advanced skills.
The root cause lies in weak authentication logic within SharePoint’s security feature implementation. An attacker exploiting this flaw can effectively disable or circumvent the security boundaries that SharePoint normally enforces, potentially gaining access to restricted sites, documents, or administrative functions.
Impact
Successful exploitation of CVE-2026-55040 grants an attacker the ability to bypass SharePoint’s security features without any credentials. The impact is severe because SharePoint often hosts sensitive organizational data, including internal documents, workflow automation, and collaboration spaces. An attacker who bypasses authentication can:
- Access restricted SharePoint sites and libraries
- Read confidential documents and files
- Potentially modify or delete content depending on permissions
- Move laterally within the network using compromised SharePoint services
The CISA Known Exploited Vulnerabilities (KEV) catalog confirms this vulnerability is being actively exploited in the wild, making remediation urgent. The EPSS score of 4.0% predicts a meaningful likelihood of exploitation within the next 30 days, though active exploitation already underway makes this a higher priority than the raw score suggests.
Remediation
Microsoft has released security updates addressing CVE-2026-55040. Organizations running SharePoint should:
- Apply the latest Microsoft patch immediately. Check the Microsoft Security Response Center for the specific update for your SharePoint version.
- Review SharePoint logs for suspicious authentication attempts or unexpected access patterns.
- Enforce multi-factor authentication (MFA) on all SharePoint accounts as a defense-in-depth measure.
- Monitor network traffic for unusual SharePoint-related activity, especially from external sources.
If patches cannot be applied immediately, restrict network access to SharePoint servers and place them behind a firewall or VPN until patching is complete.
Security Insight
This vulnerability underscores a recurring pattern in Microsoft’s collaboration stack: authentication bypass flaws in SharePoint have been a steady source of high-severity incidents, including SharePoint RCE CVE-2026-45659 added to CISA KEV after active exploitation. The rapid transition from disclosure to active exploitation - mirroring trends seen in this week’s threat roundup covering Orkes Conductor RCE and APT28 DNS hijacking - indicates threat actors are prioritizing identity-based attacks over memory-corruption exploits. Organizations should treat SharePoint as a crown-jewel asset and apply patches within days, not weeks, of release.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| sfewer-r7/CVE-2026-55040 Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040) | ★ 53 |
| l0ggg/CVE-2026-55040 Exploit code for CVE-2026-55040, it can create auth header for any validate account. | ★ 2 |
Showing 2 of 2 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....
Other Microsoft Sharepoint Server Vulnerabilities
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....