CVE-2026-55040

What is Microsoft SharePoint Server?

SharePoint Server is Microsoft's on-premises collaboration and document management platform. It stores intranet content, document libraries, and business process data, and it integrates directly with Active Directory for identity. Many deployments are published to the internet to support extranet access or remote staff.

That makes an on-premises SharePoint farm an unusually rich target: it holds the documents an organisation considers worth centralising, it authenticates against the domain, and it runs privileged server-side code. The 2025 ToolShell exploitation wave established on-prem SharePoint as a reliable initial-access target for both criminal and state-aligned actors — this CVE lands in that same context.

Overview

CVE-2026-55040 is a weak authentication flaw (CWE-1390) in SharePoint's JSON Web Token validation. Four independent weaknesses in the token-handling code combine to let an unauthenticated remote attacker forge a valid-looking JWT and act as any SharePoint site user, including a site administrator. CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N).

Microsoft fixed it in the July 2026 Patch Tuesday release, coordinated with reporter Rapid7. Rapid7 published a full technical analysis and a working proof-of-concept on 2026-08-13, and exploitation attempts spiked within hours. CISA added the CVE to KEV on 2026-08-18 with a 2026-08-21 deadline.

Affected Versions

The advisory addresses on-premises SharePoint Server; SharePoint Online is not listed as affected.

Technical Details

The flaw lives in the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. No single defect here is sufficient on its own — the bypass is a chain of four validation failures:

1. Signed tokens not required. Outer token validation explicitly sets RequireSignedTokens = false, so a token declaring alg: none skips cryptographic verification entirely.
2. Unverified x5t key resolution. The inner actor token's signing key is resolved from the x5t (X.509 certificate thumbprint) header without ever verifying that the signature validates against the resolved key.
3. Unregistered certificates accepted. When a certificate is not present in TrustedSecurityTokenServices, issuer validation accepts the issuer unconditionally instead of rejecting it.
4. Signature check is not cryptographic. GetTokenSignature only requires that the signature value be non-empty. A literal string such as AAAA satisfies it.

Forging the token. The attacker builds a nested JWT: an outer token using alg: none, wrapping an actor token whose x5t header points at SharePoint's own STS certificate thumbprint, carrying an arbitrary signature string and the target identity in the nameid claim.

Prerequisites are modest. The target hostname and realm GUID are both publicly discoverable — the realm and STS certificate can be retrieved unauthenticated from /_layouts/15/metadata/json/1. The attacker must also name the identity to impersonate: a SID (enumerable with domain controller access) or, more simply, a User Principal Name. No valid credentials are needed at any point.

Discovery

Reported by Stephen Fewer of Rapid7, disclosed in coordination with Microsoft on 2026-07-14. Rapid7 released the detailed root-cause analysis and proof-of-concept on 2026-08-13.

Rapid7 also chained this bypass with a separate, then-unpatched RCE vulnerability to achieve full unauthenticated remote code execution. That second bug was reported separately and scheduled for an August 2026 fix — applying the July update breaks the chain by removing the authentication weakness it depends on.

Exploitation Context

Exploitation tracks the PoC release closely. KEVIntel telemetry recorded 12 exploitation attempts since 2026-07-19, with 8 of them on 12–13 August — clustered directly on the publication of Rapid7's analysis. Traffic came from 8 unique IP addresses across five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the United States. Defused Cyber independently tracked actors using the public exploit.

Rapid7's PoC does more than forge a token: it uses the forged JWT to query the target's domain controller, enumerate users by SID, and automatically locate a site administrator to impersonate. Attribution and end goals remain unclear.

The practical concern is that the authentication bypass is a stepping stone. Site-administrator access to a SharePoint farm typically leads to server-side code execution paths, credential material, and lateral movement into the domain.

Remediation

1. Apply the July 2026 update for your edition — KB5002882 (Subscription Edition), KB5002883 (2019), or KB5002891 (Enterprise Server 2016). There are no documented interim mitigations.
2. Treat unpatched internet-facing farms as compromised. The PoC has been public since 13 August and exploitation is confirmed.
3. Hunt in IIS logs for unauthenticated requests to /_layouts/15/metadata/json/1 (realm and STS certificate reconnaissance), and for authenticated activity that has no corresponding sign-in event.
4. Review site collection administrator membership and permission changes for entries you cannot account for.
5. Audit for follow-on execution — new or modified web parts, unexpected files in the layouts directory, and w3wp.exe spawning child processes.
6. Rotate credentials and secrets reachable from the farm — service accounts, connection strings, and the farm account — if you find evidence of impersonation.