Full Report
Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code. The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch Tuesday updates. "The authentication
Analysis Summary
# Vulnerability: Microsoft SharePoint Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-55040
- **CVSS Score:** 9.1 (Critical)
- **CWE:** Weak Authentication / Security Feature Bypass (Impersonation)
## Affected Systems
- **Products:** Microsoft SharePoint Server
- **Versions:** Impacted versions prior to the July 2026 security updates.
- **Configurations:** Systems utilizing JWT (JSON Web Token) token validation for Bearer service-to-service (S2S) tokens.
## Vulnerability Description
The flaw resides in the JWT token validation pipeline, specifically within the `SPJsonWebSecurityTokenHandlerV2` and `SPJsonWebSecurityBaseTokenHandlerV2` classes. It involves a chain of four weaknesses:
1. **Header Manipulation:** The system accepts JWTs with the "alg: none" header, bypassing signature requirements for the outer token.
2. **Thumbprint Spoofing:** The actor token’s `x5t` header can be set to SharePoint’s own STS certificate thumbprint, allowing key resolution without verification.
3. **Issuer Validation Failure:** The resolved certificate is accepted even if it is not in the `TrustedSecurityTokenServices` list.
4. **Signature Omission:** The system fails to verify the signature of the actor token, even if a placeholder value is provided.
This chain allows an unauthenticated attacker to forge a valid JWT and impersonate any SharePoint site user or administrator.
## Exploitation
- **Status:** Exploited in the wild. Public Proof-of-Concept (PoC) code is available (Python-based).
- **Complexity:** Low (Automated PoCs exist to enumerate users and identify administrators).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Attacker can disclose files).
- **Integrity:** High (Attacker can modify data).
- **Availability:** None (According to vendor advisory).
## Remediation
### Patches
- **Microsoft July 2026 Patch Tuesday:** Users should apply the official security updates provided by Microsoft for their specific SharePoint Server version.
### Workarounds
- No specific software workarounds were provided in the article; immediate patching is the recommended course of action due to active exploitation.
## Detection
- **Indicators of Compromise:** Monitor for unusual JWT token activity involving "alg: none" or unauthorized impersonation of administrative accounts.
- **Detection methods and tools:**
- Review SharePoint logs for Bearer S2S token authentication events.
- Monitor for specific scanning/enumeration behavior (e.g., querying domain controllers for SIDs via SharePoint).
- Reference KEVIntel telemetry for known malicious IP addresses originating from Hong Kong, Japan, Netherlands, Taiwan, and the U.S.
## References
- **Vendor Advisory:** Microsoft July 2026 Security Update [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040] (Defanged)
- **Rapid7 Research:** [https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/] (Defanged)
- **Exploitation Tracking:** [https://kevintel.com/CVE-2026-55040] (Defanged)
- **PoC Repository:** [https://github.com/sfewer-r7/CVE-2026-55040] (Defanged)