From PoC to Payload: CVE-2026-55040 SharePoint Auth Bypass Sees Rapid Exploitation

Summary

CVE‑2026‑55040 is a critical authentication bypass vulnerability in Microsoft SharePoint Server, carrying a CVSS score of 9.1. The flaw resides in the JSON Web Token (JWT) validation pipeline used for Bearer service‑to‑service (S2S) tokens, and stems from a chain of four distinct weaknesses in the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. Microsoft patched the issue as part of its July 2026 Patch Tuesday updates.

Successful exploitation allows a completely unauthenticated remote attacker to forge a valid‑looking JWT and impersonate any SharePoint site user, including an administrator. Microsoft's advisory confirms the flaw does not affect system availability, but it does permit file disclosure and data modification — both severe outcomes for an internet‑facing collaboration platform.

Vulnerability Details

Root Cause Analysis

CVE‑2026‑55040 traces back to fundamental weaknesses in how SharePoint validates Bearer S2S JWTs. A four‑step chain of failures that, combined, allow a completely forged token to be treated as trustworthy:

1. ● The attacker submits a JWT with "alg": "none" in the outer header, removing the requirement for a valid signature on the outer token entirely.
2. ● The actor token's x5t header is set to SharePoint's own Security Token Service (STS) certificate thumbprint, tricking the validation logic into resolving a signing key without properly verifying it.
3. ● Even when the resolved certificate is not present in the server's TrustedSecurityTokenServices list, the system still accepts the token issuer — a check that should have rejected the request outright.
4. ● Finally, the actor token's signature field is populated with an arbitrary, non‑empty value (for example, "AAAA"), which the validation pipeline never actually verifies.

Each of these steps is a distinct logic flaw; none is exploitable alone at this severity. Chained together, they let an attacker construct a JWT that SharePoint's token handlers accept as legitimate — without ever presenting a real signature or a certificate the server actually trusts. Because the flaw sits in the S2S token handling used for internal trust relationships, a successfully forged token can be used to impersonate any site user, including a farm administrator.

How CVE‑2026‑55040 Can Be Exploited

Attack prerequisites

1. ● Network reachability to a SharePoint Server Subscription Edition endpoint that exposes the S2S JWT authentication path.
2. ● Knowledge of SharePoint's own STS certificate thumbprint, used to populate the actor token's x5t header.
3. ● No valid credentials, prior access, or user interaction of any kind — the vulnerability is exploitable pre‑authentication.

Conceptual exploitation flow

1. ● The attacker crafts an outer JWT header with "alg": "none", removing the outer signature requirement.
2. ● The actor token's x5t header is set to SharePoint's own STS certificate thumbprint, causing the server to resolve a signing key improperly.
3. ● The forged token is submitted with an arbitrary, unverified signature value.
4. ● SharePoint's token handlers accept the forged token as valid and grant the attacker the identity specified in the token's claims — up to and including a site administrator.
5. ● With administrator‑level impersonation, the attacker can enumerate users, access protected SharePoint API endpoints, disclose files, and modify data across the farm.

PoC automates this flow to query a target's domain controller, enumerate users by Security Identifier (SID), and locate the SID belonging to a site administrator. A simplified conceptual outline of that logic:

# Simplified conceptual representation of the PoC logic
# This is illustrative and not the full exploit code.

import requests
import json

def forge_jwt_token(sts_thumbprint):
    # Craft a JWT with alg: none, spoofed x5t, and dummy signature
    header = {"alg": "none", "x5t": sts_thumbprint}
    payload = {"iss": "spoofed_issuer", "aud": "sharepoint_audience", "exp": 1234567890}
    signature = "AAAA"  # Dummy signature, never verified

    encoded_header = base64url_encode(json.dumps(header))
    encoded_payload = base64url_encode(json.dumps(payload))

    forged_token = f"{encoded_header}.{encoded_payload}.{signature}"
    return forged_token

def exploit_sharepoint(target_url, forged_token):
    headers = {"Authorization": f"Bearer {forged_token}"}
    response = requests.get(f"{target_url}/_api/web", headers=headers, verify=False)

    if response.status_code == 200:
        print("Authentication bypass successful! Access granted.")
        print(response.json())
    else:
        print(f"Failed to bypass authentication. Status code: {response.status_code}")
        print(response.text)

Chaining to remote code execution

Research further demonstrated that CVE‑2026‑55040 can be chained with a second flaw, CVE‑2026‑63520 (CVSS 8.1) — an unsafe .NET type instantiation in SharePoint's Business Connectivity Services — to achieve unauthenticated remote code execution. This second flaw affects SharePoint Server Subscription Edition, 2019, and 2016, as well as Project Server 2013 SP1 and Office Web Apps 2013 SP1.

Impact

MITRE ATT&CK Mapping

Mitigation

1. ● Apply Microsoft's July 2026 Patch Tuesday update for CVE‑2026‑55040 immediately; it also breaks the RCE chain with CVE‑2026‑63520.
2. ● Ensure all SharePoint instances — Server Subscription Edition, Server 2019, and Server 2016 — are fully updated to their patched versions.
3. ● Review SharePoint authentication and access logs for anomalous S2S token activity or unexpected administrative actions.
4. ● Restrict direct internet exposure of SharePoint management and API endpoints wherever possible.
5. ● Monitor for indicators of compromise associated with this campaign and correlate against the known attacker IP ranges reported in Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.

Instantly Fix Risks with Saner Patch Management