DEV Community

Tudorel Iancu
Tudorel Iancu

Posted on

SharePoint CVE‑2026‑55040: JWT Bypass Exploited Worldwide – Patch Now

Threat Overview

🚨 Microsoft SharePoint now has a critical flaw, CVE-2026-55040, that has already started being exploited in the wild.
⚠️ The vulnerability scores a 9.1 on CVSS and lets unauthenticated attackers bypass authentication to perform arbitrary operations on any affected site.

Vulnerability Technical Background

🔍 The root cause is a flaw in SharePoint’s JWT token validation chain used for service‑to‑service (S2S) communication.
❌ Two internal classes, SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2, incorrectly parse the outer header of a JWT, allowing attackers to skip signature verification under certain conditions.

Exploit Chain Step‑by‑Step

1️⃣ The attacker crafts a JWT with alg=none in its outer header, effectively removing the requirement for an outer token signature.
2️⃣ An inner actor token is embedded that includes SharePoint’s own STS certificate thumbprint, tricking SharePoint into resolving a signing key without proper verification.
3️⃣ The resolved certificate is not listed in TrustedSecurityTokenServices, letting the issuer claim be accepted unquestioned.
4️⃣ The actor token’s signature can simply be a non‑empty placeholder like AAAA, which never gets validated, leaving the chain open for injection.

Proof of Concept Availability

🔐 A fully functional Python PoC was released by Rapid7 earlier this week.

# forge_jwt.py – minimal example
import jwt, requests

def craft_token():
    header = {"alg": "none", "typ":"JWT"}
    payload = {"iss":"https://sharepoint.com","aud":"https://sts.sharepoint.com"} 
    return jwt.encode(payload, key=None, algorithm="none", headers=header)

token = craft_token()
print("Forged token:", token)
Enter fullscreen mode Exit fullscreen mode

⚙️ The script demonstrates forging the JWT chain, querying a target domain controller, enumerating user SIDs, and automatically identifying site administrators.

📂 Full source code is available at hxxps://githubcom/sfewer-r7/CVE-2026-55040.

Active Exploitation Landscape

🚨 Telemetry from KEVIntel shows twelve distinct exploitation attempts logged since the July 2026 Patch Tuesday release.
🗓️ Eight of those occurred on August 12 and 13, directly after the PoC’s public availability.
🌐 The attacks originate from five geopolitical regions – Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. – indicating a distributed threat actor presence.

Geographic Distribution Simplified

🇭🇰 HK – ~30% of attempts

🇯🇵 JP – ~20%

🇳🇱 NL – ~15%

🇹🇼 TW – ~10%

🇺🇸 US – ~25%

Potential Impact

📦 The authentication bypass grants attackers full read/write capabilities across all SharePoint sites on a compromised server.
💣 This enables data exfiltration, modification of critical documents, injection of malicious code, and potential pivot to other internal assets.
🔍 Importantly, the flaw does not affect system availability; however, its stealthy nature makes detection challenging.

Why this matters

⚡ SharePoint is widely used in enterprises for collaboration and document management.

🚨 A single unauthenticated vulnerability that grants unrestricted access can compromise entire business workflows and intellectual property.

🔐 It highlights the risks of legacy JWT handling, reinforcing the need for strict signature validation in all authentication flows.

Mitigation Steps

1️⃣ Patch Immediately – Apply the July 2026 security update that Microsoft released for SharePoint; this patch removes the flawed JWT parsing logic.
2️⃣ Isolate Affected Services – If immediate patching is infeasible, place vulnerable instances behind a tighter perimeter by restricting inbound S2S traffic to known IP ranges or enforcing network segmentation.
3️⃣ Disable Legacy Token Support – Where possible, disable legacy JWT support in SharePoint configuration settings to eliminate the attack surface.

Detection & Monitoring

🚦 Security teams should enable detailed flow logs for all SharePoint endpoints.

🔎 Look specifically for anomalous JWT traffic patterns such as alg=none headers, actor tokens with placeholder signatures, or repeated SID enumeration queries.

  • ⚠️ Set up alerts for any S2S authentication requests that do not include a valid signature.
  • 🔗 Correlate authentication logs with directory services activity to spot suspicious user enumeration attempts.

Incident Response Guidance

1️⃣ Contain – Immediately isolate affected SharePoint servers from the network to prevent lateral movement.

2️⃣ Forensic Analysis – Review JWT logs, identify forged tokens, and verify whether any data was altered or exfiltrated; check for changes in permission sets or new admin accounts created during the exploitation window.

✅ Once confirmed, reset all compromised user credentials, revoke any newly issued tokens, and restore systems from trusted backups before re‑integrating them into production.

Long‑Term Security Posture

🔐 The CVE-2026‑55040 incident underscores the necessity of a zero‑trust approach to authentication.

🛡️ Regularly audit JWT validation logic for any legacy or custom handlers.

🚫 Enforce strict signature checks and reject any token with alg=none.

🌐 Migrate to modern identity platforms that do not rely on SharePoint’s older S2S mechanisms.

Summary & Call to Action

🔑 This vulnerability demonstrates the rapid transition from flaw disclosure to active exploitation.

📌 Administrators must apply the official patch without delay, audit their token handling pipelines, and stay vigilant for anomalous authentication traffic.

📰 For further technical details, consult the security brief at hxxps://wwwsecurityweekcom/sharepoint-vulnerability-exploited-shortly-after-poc-release/, the AlienVault Pulse at hxxps://otxalienvaultcom/pulse/6a7d7a396bb9ec2b4d156e33, and TheHackerNews article at hxxps://thehackernewscom/2026/08/attackers-exploit-sharepoint.html.

🤝 If you liked this article, please share it with your team to help spread the word!

Top comments (0)