Microsoft SharePoint — Active Exploitation of S2S Authentication Bypass Following PoC Release (CVE-2026-55040)

Publication date: August 13, 2026
Category: Vulnerability / Enterprise Security

Introduction

Threat actors have initiated active exploitation campaigns targeting a critical authentication bypass vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040 (CVSS v3.1 score: 9.1), shortly after the public disclosure of a Python-based proof-of-concept (PoC) exploit developed by Rapid7 researchers. The vulnerability, originally patched by Microsoft as part of the July 2026 Patch Tuesday update cycle, represents the fifth SharePoint security flaw to be weaponized in real-world attacks this year. Telemetry data compiled by threat intelligence platforms confirms a surge in exploitation attempts originating from multiple international IP addresses.

What is CVE-2026-55040? (General Analysis)

Vulnerability CVE-2026-55040 is a weak authentication flaw officially designated under CWE-1390 (Weak Authentication). Backed by an official confirmed CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical), the issue stems from severe design flaws within the JSON Web Token (JWT) validation and security token handling pipeline for server-to-server (S2S) communications in Microsoft Office SharePoint.

Within SharePoint’s architecture, S2S Bearer tokens authenticate communications between farm components and dependent services. The flaw permits an unauthenticated remote attacker to craft a forged token that the system incorrectly accepts, allowing complete impersonation of legitimate site users or administrators. Successful exploitation grants the capability to disclose files and modify data, while system availability remains unaffected.

How Does It Work? (Technical Analysis)

The exploitation mechanism identified and analyzed by Rapid7 chains four distinct weaknesses within the software classes responsible for token parsing and validation (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2).

• Initial Entry & Signature Bypass: The attacker transmits a manipulated JWT containing "alg: none" in its outer header, fraudulently indicating that no cryptographic signature is required for verification.
• Thumbprint Manipulation & Key Resolution: The actor token’s x5t header includes SharePoint’s own STS (Security Token Service) certificate thumbprint, forcing the system to resolve a signing key without performing actual verification.
• Trust Store Bypass: The resolved certificate is improperly accepted without checking against the TrustedSecurityTokenServices repository, enabling an unauthorized issuer to pass validation.
• Unverified Dummy Signature: The signature field inside the actor token is set to a non-empty dummy value (e.g., AAAA), which is entirely bypassed and never mathematically verified by the token handler.

“The chaining of these logical defects within the JWT validation pipeline allows an unauthenticated remote attacker to forge a valid token and successfully impersonate any SharePoint site user or administrator.”

Rapid7’s public PoC automates these steps to query a target domain controller, enumerate users by their Security Identifiers (SID), and automatically locate administrative accounts.

Affected Systems / Environments

Organizations operating on-premises deployments of Microsoft SharePoint that have not applied the cumulative security patches released in July 2026 remain vulnerable to remote compromise.

Note: All listed CVEs are currently included in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Mitigation and Detection

Remediation

• Patch Deployment: Immediately apply Microsoft’s cumulative security update bulletins published in July 2026 for SharePoint.
• Network Segmentation & WAF: Restrict external access to SharePoint web services using Web Application Firewalls and strict network segmentation to limit exposure.
• S2S Trust Review: Audit security token service configurations to ensure no untrusted certificates or issuers reside within trusted stores.

Detection

• IIS Log Analysis: Inspect Internet Information Services (IIS) logs for anomalous HTTP requests targeting SharePoint endpoints handling Bearer tokens or JWT headers featuring null algorithms.
• Network Intrusion Detection (IDS/IPS): Deploy custom detection rules to identify traffic signatures associated with automated SID enumeration following token spoofing.

// Sample KQL query for detecting suspicious HTTP request anomalies toward SharePoint
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has "/_layouts/" or csUriStem has "/_api/"
| where scStatus == 200 and csMethod == "POST"
| summarize RequestCount = count() by cIP, useragent
| where RequestCount > 100

Wrapping Up

The rapid weaponization of CVE-2026-55040 following the publication of Rapid7’s PoC code underscores the speed at which threat actors operationalize complex logical vulnerabilities. By exploiting flaws in JWT token validation pipelines, attackers successfully bypass perimeter defenses protecting critical enterprise assets. Prompt patch management and rigorous monitoring of S2S authentication workflows remain fundamental pillars for defending exposed SharePoint environments.

References

• Lakshmanan, R. (2026). Attackers Exploit SharePoint Authentication Bypass After Public PoC Release. The Hacker News. https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
• Rapid7. (2026). Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040). Rapid7 Blog. https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040
• Rapid7. (2026). Python-based PoC for CVE-2026-55040. GitHub. https://github.com/sfewer-r7/CVE-2026-55040
• KEVIntel. (2026). Telemetry data on CVE-2026-55040 exploitation attempts. https://kevintel.com/CVE-2026-55040
• Microsoft. (2026). ADV-2026 / MSRC Security Update Guide: CVE-2026-55040. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
• Microsoft. (2026). MSRC Security Update Guide: CVE-2026-45659. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
• Microsoft. (2026). MSRC Security Update Guide: CVE-2026-56164. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
• Microsoft. (2026). MSRC Security Update Guide: CVE-2026-58644. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
• Microsoft. (2026). MSRC Security Update Guide: CVE-2026-50522. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
• Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-55040, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522). US Government Resource. https://www.cisa.gov/known-exploited-vulnerabilities-catalog