# SharePoint JWT validation chain, forge a token and become any user

Source: https://startwithidentity.com/cves/cve-2026-55040/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-55040 (CVSS 9.1) is an authentication bypass in SharePoint Server built from four separate weaknesses in how two token handler classes validate [JWTs](https://startwithidentity.com/glossary/jwt/). No single one of them is the bug. Chained, they let an unauthenticated attacker present a forged token that passes validation and act as a site user or a site administrator.

Microsoft patched it in the July 2026 Patch Tuesday release. Rapid7 published a Python proof of concept in the week of August 13, 2026. KEVIntel telemetry recorded a dozen exploitation attempts from eight IP addresses across Hong Kong, Japan, the Netherlands, Taiwan and the United States, with the first on July 19 and a spike of eight on August 12 and 13, immediately following the PoC. It is the fifth SharePoint flaw exploited in 2026.

## Why it matters

This is the same failure mode as [CVE-2023-29357](https://startwithidentity.com/cves/cve-2023-29357/), where `ReadTokenCore()` honoured `alg:none` and skipped signature verification entirely. Three years later, the same product, the same trust decision, a different route to it. When a validator has four independent weaknesses that compose, the problem is not any one check. It is that token validation is spread across handler classes that each assume a different one did the work.

The identity lesson is about who a forged token makes you. SharePoint is a resource server that many organizations also treat as an intranet [identity provider](https://startwithidentity.com/glossary/identity-provider/), so a token accepted here is a token accepted by everything that federates from here. And the exploitation timeline is the practical part: patch available mid-July, PoC mid-August, mass scanning within 48 hours. The window between public exploit and mass exploitation for internet-facing identity surfaces is now measured in days.

## What to do

- Apply the July 2026 SharePoint updates. Confirm the build number rather than trusting the update history.
- Take on-premises SharePoint off the public internet, or put it behind a reverse proxy that authenticates before SharePoint sees the request.
- Reject tokens that select their own algorithm, and validate issuer, audience, expiry, and signature in one place. See the [validate a JWT recipe](https://startwithidentity.com/recipes/validate-a-jwt/).
- Alert on authenticated SharePoint activity with no preceding sign-in event, which is the signature a forged token leaves.

## After you patch

- Review farm administrator membership, site collection administrators, and app principal grants for entries added since July 2026.
- Revoke and reissue SharePoint app principal secrets and certificates.
- Check for web shells and modified layout files, the usual follow-on from the 2025 ToolShell campaign against the same product.
- Rotate the farm's machine keys if you cannot rule out access, since a stolen key turns a patched server back into a forgeable one.

## Sources

- [NVD: CVE-2026-55040](https://nvd.nist.gov/vuln/detail/cve-2026-55040)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
- [The Hacker News, August 13, 2026](https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html)