The new cmis query enpoint is /alfresco/api/-default-/public/cmis/versions/1.1/atom/query
The endpoint belongs to alfresco repo. It should be possible to access it via Share's proxy (/share/proxy/alfresco/...) but it turns out that it's not possible because /alfresco/api is not mapped (only /alfresco/service is).
Even after configuring an additional proxy endpoint, authentication is not passed from share to repo.
As a workaround, we're using the direct repo url, but this will prompt the user for credentials via an annoying basic http auth popup, at every CMIS request (at least in Safari).
See discussion:
https://forums.alfresco.com/forum/developer-discussions/alfresco-api/cmis-11-browser-bindings-share-proxy-06042014-1243