Critical Microsoft SharePoint CVE-2023-29357 Actively Exploited

Key Takeaways

• A critical authentication bypass vulnerability, CVE-2026-55040, in Microsoft SharePoint Server is being actively exploited in the wild.
• The flaw allows unauthenticated attackers to forge authentication tokens and impersonate any SharePoint user, including administrators.
• The vulnerability affects on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online is not impacted.
• Microsoft issued patches in July 2026, but many servers remain unpatched and vulnerable.
• When combined with CVE-2026-63520, this vulnerability can lead to remote code execution.

Critical SharePoint Flaw Actively Exploited Following PoC Release

Cybersecurity researchers are reporting widespread exploitation of a newly disclosed critical vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-55040. Threat actors began leveraging the flaw in real-world attacks against internet-facing servers mere hours after Rapid7 published a comprehensive technical analysis and proof-of-concept (PoC) exploit.

This authentication bypass vulnerability carries a severe CVSS score of 9.1. It enables a remote, unauthenticated attacker to craft a valid authentication token, thereby impersonating any user within SharePoint, including site administrators, without requiring a password or existing session cookie.

The swift weaponization of the exploit was corroborated by threat intelligence firm Defused. The firm observed suspicious activity targeting its SharePoint honeypots, confirming that attackers were “now using the @rapid7 POC for CVE-2026-55040” against exposed systems.

Rapid7 security researcher Stephen Fewer released a detailed write-up and a Python-based exploit script, illustrating the precise method for abusing the vulnerability. Within a single day, defenders noted that this same code was being repurposed for live attacks.

Technical Breakdown of CVE-2026-55040

CVE-2026-55040 resides within SharePoint’s JSON Web Token (JWT) validation process, specifically impacting the internal classes SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2, which are responsible for parsing Bearer service-to-service tokens. Rapid7 identified four distinct weaknesses that collectively undermine the entire authentication mechanism.

The attack chain begins when an attacker sends a token with its outer header configured as “alg: none,” effectively bypassing any signature requirement. Subsequently, the token’s x5t header can be directed to SharePoint’s own security token service certificate thumbprint. This thumbprint is publicly exposed on an unauthenticated metadata endpoint, allowing the server to resolve a signing key without legitimate verification.

Compounding the issue, this certificate is not listed in SharePoint’s TrustedSecurityTokenServices registry, yet the issuer is accepted regardless. Finally, the signature field only needs to contain a non-empty placeholder value, as the underlying code fails to perform any cryptographic validation.

When these vulnerabilities are chained together, an attacker can submit a self-issued token claiming any identity, including a domain administrator, and SharePoint will accept it as authentic. Rapid7’s PoC further demonstrates this by using the forged token to query a target’s domain controller, enumerate user accounts via SID, and automatically identify the site administrator account for complete impersonation.

Affected Versions and Patch Information

Microsoft addressed CVE-2026-55040 in its July 2026 Patch Tuesday updates. The advisory described it as a weak authentication issue where “the authentication feature could be bypassed as this vulnerability allows impersonation.” The company noted that successful exploitation could lead to file disclosure and data modification but would not impact system availability.

The vulnerability exclusively impacts on-premises deployments: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Cloud-hosted SharePoint Online instances are not affected.

Despite the patch being available for approximately a month, security researchers caution that thousands of internet-facing SharePoint servers remain unpatched and vulnerable to exploitation.

Notably, CVE-2026-55040 can also serve as the initial vector in a more severe attack chain. When combined with CVE-2026-63520, a separate remote code execution flaw disclosed in Microsoft’s August Patch Tuesday, an unauthenticated attacker could escalate from impersonation to full code execution on a compromised server.

What You Should Do

• Immediately apply the July and August 2026 security updates for all on-premises SharePoint Server deployments.
• Restrict internet exposure of SharePoint servers to the absolute minimum necessary.
• Monitor authentication logs for any anomalous service-to-service token activity.
• Given the rapid weaponization of this PoC, treat all unpatched, publicly accessible SharePoint deployments as an urgent and active risk.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.