Threat actors have wasted no time weaponizing a newly disclosed Microsoft SharePoint authentication bypass, launching real-world attacks against internet-facing servers just hours after security firm Rapid7 published a technical breakdown and proof-of-concept exploit for the flaw.

The vulnerability, tracked as CVE-2026-55040 and carrying a critical CVSS score of 9.1, allows a remote, unauthenticated attacker to forge a valid authentication token and impersonate any SharePoint user, including a site administrator, without ever needing a password or session cookie.

Threat intelligence firm Defused confirmed the exploitation trend after observing suspicious activity hitting its SharePoint honeypots, warning that attackers were “now using the @rapid7 POC for CVE-2026-55040” against exposed systems.

Rapid7 security researcher Stephen Fewer published a detailed write-up and an accompanying Python-based exploit script, laying bare exactly how the flaw can be abused, and within a day, defenders were seeing the same code repurposed for live attacks.

CVE-2026-55040 lives inside SharePoint’s JWT (JSON Web Token) validation pipeline, specifically in two internal classes called SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 that handle Bearer service-to-service token parsing. Rapid7 found that four separate weaknesses combine to break authentication entirely.

How the Attack Works

First, an attacker can send a token with its outer header set to “alg: none,” meaning no signature is required at all. Second, the token’s x5t header can be pointed at SharePoint’s own security token service certificate thumbprint, which is exposed on an unauthenticated metadata endpoint, letting the server resolve a signing key without real verification.

Third, because that certificate isn’t listed in SharePoint’s TrustedSecurityTokenServices registry, the issuer gets accepted anyway. Finally, the signature field only needs to contain some non-empty value, such as a placeholder string, since the code never actually checks whether it’s cryptographically valid.

Chained together, these gaps let an attacker submit a self-issued token naming any account, including a domain administrator, and have SharePoint accept it as legitimate.

Rapid7’s PoC goes a step further by using the forged token to query a target’s domain controller, enumerate user accounts by SID, and automatically locate the site administrator account for full impersonation.

Microsoft quietly fixed CVE-2026-55040 during its July 2026 Patch Tuesday rollout, describing it in its advisory as a weak authentication issue where “the authentication feature could be bypassed as this vulnerability allows impersonation.”

The company noted that successful exploitation could let an attacker disclose files and modify data, though it would not affect system availability.

The flaw affects on-premises deployments only: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Cloud-hosted SharePoint Online is not impacted.

Despite the patch being available for roughly a month, security researchers warn that thousands of internet-facing SharePoint servers remain unpatched and exposed.

Notably, CVE-2026-55040 is also the first link in a more dangerous chain: when combined with a separate remote code execution flaw, CVE-2026-63520, disclosed alongside Microsoft’s August Patch Tuesday, an unauthenticated attacker could escalate from impersonation to full code execution on a vulnerable server.

Organizations running on-premises SharePoint should apply the July and August 2026 security updates immediately, restrict internet exposure of SharePoint servers, and monitor authentication logs for anomalous service-to-service token activity.

Given the speed at which this PoC has already been weaponized, unpatched, publicly reachable SharePoint deployments should be treated as an active, urgent risk.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC Release appeared first on Cyber Security News.

Swiss federal authorities have confirmed a cyberattack targeting SharePoint servers operated by the Federal Office for Information Technology and Telecommunication (BIT).

The incident resulted in the compromise of login credentials linked to approximately 200 user and technical accounts. BIT detected unusual activity on its SharePoint environment on Tuesday, July 28.

Security specialists quickly investigated the anomalies and confirmed that the servers may have been targeted through recently disclosed Microsoft SharePoint vulnerabilities.

The agency immediately blocked internet access to the affected SharePoint systems and applied the required security fixes. Microsoft disclosed multiple SharePoint vulnerabilities in mid-July.

Organizations widely use SharePoint for document storage, collaboration, internal communication, and file sharing. BIT operates several SharePoint servers in Swiss federal data centers to support government services and employee workflows.

Hackers Breach Swiss SharePoint

After Microsoft released security updates, BIT began installing the patches on its systems. However, investigators believe unknown threat actors may have exploited the vulnerabilities before all defensive actions were completed.

The exact identity, origin, and motives of the attackers remain unknown. During the ongoing forensic investigation, security teams discovered on Friday, July 31, that several login credentials had been compromised.

The affected accounts included both standard user accounts and technical accounts used by systems or applications. BIT responded by resetting passwords for all impacted accounts.

Authorities said current analysis has not identified evidence that files, documents, or other data were exfiltrated from the SharePoint platform. The compromise appears to be limited to credentials associated with around 200 accounts.

Investigators also noted that confidential government information and highly sensitive personal data are not permitted to be stored on the affected SharePoint environment.

BIT is working with the Federal Office for Cyber Security (BACS) and Microsoft to investigate the intrusion and determine the full scope of the attack. The technical investigation remains active, and authorities have not ruled out further findings as forensic work continues.

As a precaution, BIT is reinstalling the affected SharePoint servers. External internet access to the platform will remain blocked until the recovery work is completed and officials confirm that the environment is secure.

Federal administration employees can still access documents internally and use alternative methods to share information with external personnel.

The incident highlights the ongoing risks facing organizations that run internet-facing collaboration platforms. SharePoint systems can become attractive targets because they often hold business documents, provide access to internal users, and integrate with other Microsoft services.

Prompt patching, credential monitoring, network restrictions, and server rebuilding remain important response measures after suspected exploitation.

BIT reported the incident to BACS and the State Secretariat for Security Policy, or SEPOS, within the required timeframe under Switzerland’s Information Security Act.

The agency also shared relevant technical indicators from the attack on critical infrastructure with operators via the BACS platform, helping other organizations identify potential signs of related intrusion activity.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Hackers Breach Swiss Government SharePoint Servers, Compromise 200 Accounts appeared first on Cyber Security News.

Attackers have compromised the GitHub account of the maintainer behind keyv, a popular key-value storage library that pulls in roughly 127 million weekly downloads on npm, and used that access to push credential-stealing malware across the maintainer’s entire package portfolio.

The breach, which unfolded on August 4, 2026, marks one of the largest npm supply chain incidents to date, with the malicious code spreading like a worm to hundreds of unrelated packages within hours. Research on the incident was exclusively shared with Cybersecuritynews by Aikido.

The same maintainer behind keyv also owns several other heavily used caching utilities, including cacheable (29 million downloads a month), flat-cache (565 million downloads a month), file-entry-cache (557 million downloads a month), cache-manager, cacheable-request, and the @cacheable scoped packages. All of them were swept into the same compromise.

Because the attacker pushed malicious files straight to each repository’s main branch and then immediately cut a new release, the poisoned versions were published to npm carrying valid provenance signatures generated by GitHub Actions, making them appear fully legitimate to anyone auditing supply chain integrity.

Keyv npm Package Compromised

Every affected package received two new files, setup.mjs and Math_Symbol.js, along with a “preinstall” hook silently added to package.json that automatically executes setup.mjs during npm install.

Once triggered, setup.mjs functions as a heavily obfuscated dropper that quietly downloads the Bun JavaScript runtime from a GitHub release URL and uses it to launch the true payload, Math_Symbol.js, without any visible prompt to the developer running the install.

This self-propagating design is what has allowed the malware, dubbed part of the Shai-Hulud campaign, to jump beyond the original maintainer’s packages and infect major organizations’ code, including releases tied to Deliveroo, Qlik, Picsart, and others.

As of an update issued at 13:20 CEST on August 4, at least 868 packages spanning 1,381 versions had been confirmed compromised, and the number continues to climb as researchers track ongoing spread across the registry, Aikido said.

Math_Symbol.js is built around a set of targeted credential extractors, each aimed at a specific secret store commonly found on developer machines and CI runners.

It harvests npm registry authentication tokens from .npmrc files, GitHub CLI tokens including classic personal access tokens, session tokens, and OIDC tokens from local GitHub CLI configuration, and AWS access keys and session tokens directly from the ~/.aws/credentials file.

The malware also attempts to capture HashiCorp Vault client tokens by reading the VAULT_TOKEN environment variable, with a fallback mechanism that tries to retrieve a token over HTTP if the environment variable isn’t present.

Because these are the exact credentials used to publish new packages and access cloud infrastructure, a single successful theft can cascade into further account takeovers and additional malicious releases, which appears to be exactly how the worm has continued propagating across the npm ecosystem.

Teams that depend on keyv, cacheable, flat-cache, file-entry-cache, or any related caching packages should immediately audit their lockfiles for the affected versions, rotate npm tokens, GitHub CLI credentials, AWS keys, and Vault tokens on any machine that ran an install during the exposure window, and avoid running fresh installs against affected dependency trees until patched versions are confirmed.

Given the scale and speed of this compromise, security teams should treat any recent CI pipeline run touching these packages as potentially exposed.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack appeared first on Cyber Security News.