Listen to this Post
How CVE-2026-55040 Works
CVE-2026-55040 is a critical security feature bypass vulnerability in Microsoft SharePoint Server, stemming from weak authentication in the JSON Web Token (JWT) validation pipeline. The flaw resides in two classes responsible for parsing and validating Bearer service-to-service (S2S) tokens: `SPJsonWebSecurityTokenHandlerV2` and SPJsonWebSecurityBaseTokenHandlerV2. Rather than a single coding error, the vulnerability chains four distinct weaknesses that allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user—including administrators.
The attack sequence unfolds as follows:
- Algorithm Confusion – The attacker sends a JWT with `”alg”: “none”` in the outer header, instructing the server that no signature is required for the outer token.
- Thumbprint Spoofing – The `x5t` header of the actor token is populated with SharePoint’s own Security Token Service (STS) certificate thumbprint. This tricks the server into resolving a signing key without performing any verification.
- Issuer Bypass – Because the resolved certificate is not listed in
TrustedSecurityTokenServices, the issuer check passes unconditionally, accepting the token as valid. - Signature Neglect – The actor token’s signature is set to a non‑empty but arbitrary value (e.g.,
"AAAA"), which is never actually verified by the server.
The result is that a remote, unauthenticated attacker can forge a JWT that SharePoint accepts as legitimate, effectively bypassing authentication entirely. The prerequisite is that the attacker must know in advance the target user’s Active Directory Security ID (SID) or User Principal Name (UPN). Rapid7’s proof‑of‑concept (PoC) demonstrates enumerating users via SID queries against the domain controller and then using the forged token to impersonate a site administrator. Microsoft patched this vulnerability on July 14, 2026, as part of its Patch Tuesday updates, but public release of the PoC has since triggered active exploitation in the wild.
DailyCVE Form:
Platform: Microsoft SharePoint Server
Version: 2016, 2019, Subscription
Vulnerability: JWT authentication bypass
Severity: CRITICAL (CVSS 9.1)
date: 2026-07-14
Prediction: Patch already released
What Undercode Say: Analytics
- CISA KEV Added: August 18, 2026
- Active Exploitation: Confirmed in the wild
- Exploitation Attempts: 12 recorded since July 19, 2026
- Peak Activity: 8 attempts on August 12–13, 2026 (post-PoC release)
- Source IPs: 8 unique addresses from 5 countries (Hong Kong, Japan, Netherlands, Taiwan, USA)
- PoC Release: Rapid7 Python-based exploit
- Exploit Chain: Can be chained with an unpatched RCE for full unauthenticated RCE
Bash commands and codes related to the vulnerability:
Check SharePoint Server version (PowerShell)
Get-SPFarm | Select-Object BuildVersion
Verify installed cumulative updates (PowerShell)
Get-HotFix | Where-Object { $_.HotFixID -like "KB50028" }
Check for vulnerable versions
Vulnerable: < 16.0.5561.1001 (2016)
Vulnerable: < 16.0.10417.20175 (2019)
Vulnerable: < 16.0.19725.20434 (Subscription Edition)
Example: Detect JWT validation issues (conceptual)
Monitor for JWT tokens with "alg: none" in logs
grep -i '"alg":"none"' /var/log/sharepoint/.log
Enumerate SharePoint site admins (PoC-style - conceptual)
python3 CVE-2026-55040.py --target https://sharepoint.target.com --enumerate
Python-based PoC snippet (conceptual – educational only):
Forged JWT construction (simplified)
import jwt
import base64
header = {
"alg": "none",
"x5t": "SHAREPOINT_STS_THUMBPRINT",
"typ": "JWT"
}
payload = {
"aud": "https://sharepoint.target.com",
"iss": "sharepoint_sts",
"upn": "[email protected]"
}
No signature – "alg: none" bypasses verification
token = base64.urlsafe_b64encode(json.dumps(header).encode()).decode().rstrip("=") + "." + \
base64.urlsafe_b64encode(json.dumps(payload).encode()).decode().rstrip("=") + "." + "AAAA"
print(token)
Exploit: (Educational Purposes!)
- Attack Vector: Remote, unauthenticated, over the network (AV:N)
- Prerequisites: Target user’s SID or UPN (obtainable via AD enumeration)
- Exploit Steps:
- Enumerate SharePoint users by querying the domain controller for SIDs
- Craft a JWT with `”alg”: “none”` in the header and the target’s UPN in the payload
- Set the `x5t` header to SharePoint’s own STS certificate thumbprint
- Set the signature to a non‑empty arbitrary value (e.g.,
"AAAA") - Send the forged token in the `Authorization: Bearer` header to the SharePoint server
- The server accepts the token, granting the attacker full impersonation privileges
– Chained Exploit: Combined with an unpatched RCE (expected August 2026 patch) to achieve unauthenticated remote code execution
Protection from this CVE
- Apply Patches Immediately: Install the July 2026 Cumulative Updates:
- SharePoint Server 2016: KB 5002891 (language‑independent) + KB 5002892 (language‑dependent)
- SharePoint Server 2019: KB 5002883 (language‑independent) + KB 5002885 (language‑dependent)
- SharePoint Server Subscription Edition: KB 5002882
- Network Hardening (CISA Recommendation): Avoid exposing SharePoint directly to the internet; place behind a Layer 7 reverse proxy with authentication controls; block external access to Central Administration
- Enable AMSI Integration in SharePoint to detect and block malicious token injection attempts
- Monitor Logs: Inspect IIS and SharePoint ULS logs for JWT tokens with `”alg”: “none”` or unusual `x5t` values
- Restrict AD SID Enumeration: Limit unauthenticated LDAP queries to prevent user enumeration
- Disable Legacy Authentication methods where possible
Impact
- Confidentiality (High): Attacker can read any document or file accessible to the impersonated user, including sensitive corporate data
- Integrity (High): Attacker can modify, create, or delete SharePoint content, workflows, and site configurations
- Availability (None): The vulnerability does not directly impact system availability
- Privilege Escalation: Allows unauthenticated attacker to assume the identity of any SharePoint site user, including site administrators
- Lateral Movement: Impersonation enables access to integrated systems (e.g., Active Directory, Microsoft 365) via SharePoint’s trusted connections
- RCE Chain: Can be combined with a second, unpatched vulnerability to achieve full unauthenticated remote code execution, giving the attacker complete control over the SharePoint server
- Widespread Exposure: Affects all supported versions of SharePoint Server (2016, 2019, Subscription Edition)
- Active Exploitation: Confirmed in‑the‑wild attacks following public PoC release, with CISA adding to the Known Exploited Vulnerabilities catalog
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
