SharePoint Authentication Bypassed

Overview

A newly disclosed Microsoft SharePoint vulnerability (CVE‑2026‑55040) is now being actively exploited following the release of a proof‑of‑concept (PoC) exploit by Rapid7. The flaw, rated CVSS 9.1, stems from weak authentication in the JWT token validation pipeline and allows attackers to impersonate SharePoint users or administrators. Microsoft patched the issue in its July 2026 Patch Tuesday updates, but unpatched servers remain at risk.

Vulnerability Details

• CVE‑2026‑55040: Authentication bypass enabling impersonation.
• Impact: Attackers can disclose files and modify data, though system availability is not directly affected.
• Root cause: Multiple weaknesses in JWT token validation logic across SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.
• Exploit chain:
  • JWT sent with alg: none (no signature required).
  • Actor token’s x5t header contains SharePoint’s STS certificate thumbprint.
  • Certificate accepted without verification.
  • Signature field ignored, allowing forged tokens.

Rapid7’s PoC demonstrates how attackers can query a domain controller, enumerate users by SID, and escalate to impersonate a site administrator.

Exploitation Activity

• Defused Cyber telemetry: 12 exploitation attempts recorded since July 19, 2026.
• Spike in activity: 8 attempts logged on August 12–13, 2026, coinciding with the PoC release.
• Origin of attacks: 8 unique IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.
• KEVIntel data: Confirms correlation between PoC release and exploitation surge.

Security Implications

• Unauthenticated access: Attackers can impersonate privileged users without credentials.
• Data exposure: Sensitive SharePoint files and configurations at risk.
• Operational impact: Potential manipulation of collaboration platforms used in enterprise environments.

Defensive Guidance

Organizations should:

• Patch immediately: Apply Microsoft’s July 2026 updates.
• Restrict exposure: Avoid direct Internet exposure of SharePoint servers.
• Harden configurations: Block external access to Central Administration and restrict farm/database communication.
• Deploy reverse proxies: Place servers behind Layer 7 application‑layer security controls.
• Monitor for impersonation attempts: Watch for suspicious JWT tokens and unauthorized file access.

Expert in the Cloud Insight

The exploitation of CVE‑2026‑55040 highlights the shrinking window between disclosure and weaponization. Attackers leveraged Rapid7’s PoC within days, proving that patch velocity is critical. SharePoint remains a high‑value target for enterprise attackers, and authentication bypass flaws are particularly dangerous because they undermine trust boundaries. For defenders, the lesson is clear: patch fast, restrict exposure, and monitor JWT activity closely.