SharePoint Auth Bypass Exposed After Public PoC Release

Microsoft SharePoint has a critical feature bypass identified as CVE‑2026‑55040 with a CVSS score of 9.1. The vulnerability allows an attacker to bypass authentication checks by manipulating HTTP header values, letting them impersonate legitimate users without valid credentials. A proof‑of‑concept code was released earlier this month, drawing attention from threat actors and defenders alike. ¹

The flaw is similar in concept to the BloodHound attack against Active Directory from 2017; both exploit trust relationships within a system for privilege escalation but target different protocols and architectures. In SharePoint’s case, the bypass exploits how the platform validates incoming requests, effectively letting malicious traffic masquerade as authorized traffic. Attackers have already begun exploiting it following the PoC release, targeting organizations that may still be running unpatched versions or misconfigured servers. ¹

Microsoft responded with its July 2026 Patch Tuesday updates, which included stricter header validation rules on