Unauthenticated attackers exploit SharePoint vulnerability to bypass authentication and hijack administrative accounts

Summary

A high-severity vulnerability in Microsoft SharePoint is being exploited in the wild following the public release of a proof-of-concept (PoC) script. The flaw, tracked as CVE-2026-55040, allows an unauthenticated attacker to bypass security features over a network to disclose files and modify data.

Exploitation attempts have been recorded by threat intelligence firm Defused via honeypots, specifically targeting the PoC released by Rapid7. While Microsoft's official advisory has not yet updated its status to include active exploitation, CISA has previously warned that this vulnerability could be exploited in the wild.

Technical Details

The vulnerability resides within the JWT (JSON Web Token) validation pipeline of SharePoint Server Subscription Edition. Specifically, the issue is located in the SPJsonWebSecurityTokenHandlerV2 class and its base class, which handle Bearer service-to-service (S2S) tokens.

SharePoint's S2S authentication relies on a nested JWT structure: an outer token containing user identity claims and an inner "actor token" embedded in the actortoken claim. The vulnerability stems from a chain of four distinct weaknesses that allow an attacker to forge a valid JWT and impersonate any SharePoint site user or administrator.

The primary weakness is found in the ValidateToken() method, where the code explicitly disables signature requirements:

// SPJsonWebSecurityTokenHandlerV2.cs - ValidateToken()
val.RequireSignedTokens = false;

By setting RequireSignedTokens to false, SharePoint instructs the underlying JWT library to accept tokens with an alg: none header. This means the system parses the token and populates claims without performing any cryptographic verification of the outer token's signature. Additionally, built-in audience and issuer validation are disabled during this process.

Exploitation Status

Exploitation of CVE-2026-55040 began shortly after Rapid7 published technical details and a PoC script on August 11. Threat intelligence indicates that current attacks are leveraging that specific public PoC.

Separately, Rapid7 has identified another flaw, CVE-2026-63520. This vulnerability could be chained with CVE-2026-55040 to achieve unauthenticated remote code execution on SharePoint servers. While this second flaw was addressed in the August Patch Tuesday updates, there is currently no indication that it is being exploited in the wild.

Why This Matters for Defenders

This is not an isolated incident; CVE-2026-55040 is the fifth SharePoint vulnerability targeted this summer. It follows a series of other disclosed flaws including CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659.

The ability for an unauthenticated attacker to bypass authentication means they can gain the privileges of a site user or administrator without valid credentials. This provides a direct path to data exfiltration and unauthorized modification of SharePoint content.

Defender Guidance

The most effective defense is to apply the patches released by Microsoft.

• Apply July 2026 Updates: CVE-2026-55040 was addressed in the July Patch Tuesday updates. Ensure all SharePoint Server Subscription Edition instances are fully patched.
• Apply August 2026 Updates: To prevent potential remote code execution through vulnerability chaining, apply the August updates that address CVE-2026-63520.
• Monitor for Anomalies: Watch for unusual service-to-service (S2S) token activity or unauthorized administrative actions within your SharePoint environments.

Proof of Concept

A working proof-of-concept script was released by Rapid7 to demonstrate how the JWT validation pipeline can be bypassed. A technical analysis and the accompanying script are available at https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/