Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
CVE-2026-55040 is a critical (CVSS 9.1) SharePoint authentication bypass vulnerability patched in Microsoft's July 2026 Patch Tuesday The flaw chains four weaknesses in the JWT token validation pipeline, allowing unauthenticated attackers to forge valid JWTs and impersonate any SharePoint user or administrator Threat actors are actively exploiting the vulnerability using a Python-based PoC released by Rapid7, with 12 recorded attempts across five countries since July 19, 2026 Exploitation enable
Analysis
TL;DR
- CVE-2026-55040 is a critical (CVSS 9.1) SharePoint authentication bypass vulnerability patched in Microsoft's July 2026 Patch Tuesday
- The flaw chains four weaknesses in the JWT token validation pipeline, allowing unauthenticated attackers to forge valid JWTs and impersonate any SharePoint user or administrator
- Threat actors are actively exploiting the vulnerability using a Python-based PoC released by Rapid7, with 12 recorded attempts across five countries since July 19, 2026
- Exploitation enables file disclosure and data modification but does not impact system availability
- Microsoft advises all SharePoint users to apply the latest patches immediately given the spike in real-world exploitation
Why It Matters
This vulnerability demonstrates the rapid real-world exploitation cycle of newly disclosed flaws, as attackers leveraged a public PoC within weeks of its release. For AI and enterprise practitioners, it underscores the critical importance of timely patch management and the risks posed by JWT validation weaknesses in authentication pipelines. The incident also highlights how service-to-service token handling can become a single point of failure when multiple validation checks are bypassed in sequence.
Technical Details
- CVE-2026-55040 affects two key classes: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2, which handle Bearer service-to-service (S2S) token parsing and validation
- The exploit chains four weaknesses: (1) "alg: none" in the outer JWT header skips signature verification, (2) the x5t header contains SharePoint's own STS certificate thumbprint to resolve a signing key without verification, (3) the resolved certificate is absent from TrustedSecurityTokenServices yet the issuer is still accepted, and (4) the actor token's signature is a non-empty but never-verified value (e.g., "AAAA")
- Rapid7's Python-based PoC uses the forged JWT to query the target's domain controller, enumerate users by SID, and auto-locate administrator SIDs for privilege escalation
- Microsoft's advisory confirms the vulnerability allows impersonation, file disclosure, and data modification, but explicitly notes that system availability is not impacted
- Telemetry from KEVIntel recorded 12 exploitation attempts from 8 unique IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S., with 8 of those attempts occurring on August 12-13, 2026, shortly after the PoC release
Industry Insight
- Organizations should prioritize applying the July 2026 Patch Tuesday updates immediately, especially for any SharePoint instances exposed to the internet or internal networks with untrusted users
- Security teams should audit JWT validation pipelines across their Microsoft 365 and SharePoint deployments, focusing on token handling classes and certificate trust configurations, to identify similar weaknesses
- The rapid transition from PoC publication to active exploitation reinforces the need for automated vulnerability management and continuous monitoring; consider deploying detection rules for anomalous JWT patterns and unauthorized authentication bypass attempts in SIEM environments
Disclaimer: The above content is generated by AI and is for reference only.