CVE-2026-55040SharePoint JWT validation chain, forge a token and become any user

What broke

CVE-2026-55040 (CVSS 9.1) is an authentication bypass in SharePoint Server built from four separate weaknesses in how two token handler classes validate JWTs. No single one of them is the bug. Chained, they let an unauthenticated attacker present a forged token that passes validation and act as a site user or a site administrator.

Microsoft patched it in the July 2026 Patch Tuesday release. Rapid7 published a Python proof of concept in the week of August 13, 2026. KEVIntel telemetry recorded a dozen exploitation attempts from eight IP addresses across Hong Kong, Japan, the Netherlands, Taiwan and the United States, with the first on July 19 and a spike of eight on August 12 and 13, immediately following the PoC. It is the fifth SharePoint flaw exploited in 2026.

Why it matters

This is the same failure mode as CVE-2023-29357, where ReadTokenCore() honoured alg:none and skipped signature verification entirely. Three years later, the same product, the same trust decision, a different route to it. When a validator has four independent weaknesses that compose, the problem is not any one check. It is that token validation is spread across handler classes that each assume a different one did the work.

The identity lesson is about who a forged token makes you. SharePoint is a resource server that many organizations also treat as an intranet identity provider, so a token accepted here is a token accepted by everything that federates from here. And the exploitation timeline is the practical part: patch available mid-July, PoC mid-August, mass scanning within 48 hours. The window between public exploit and mass exploitation for internet-facing identity surfaces is now measured in days.

What to do

• Apply the July 2026 SharePoint updates. Confirm the build number rather than trusting the update history.
• Take on-premises SharePoint off the public internet, or put it behind a reverse proxy that authenticates before SharePoint sees the request.
• Reject tokens that select their own algorithm, and validate issuer, audience, expiry, and signature in one place. See the validate a JWT recipe.
• Alert on authenticated SharePoint activity with no preceding sign-in event, which is the signature a forged token leaves.

After you patch

• Review farm administrator membership, site collection administrators, and app principal grants for entries added since July 2026.
• Revoke and reissue SharePoint app principal secrets and certificates.
• Check for web shells and modified layout files, the usual follow-on from the 2025 ToolShell campaign against the same product.
• Rotate the farm's machine keys if you cannot rule out access, since a stolen key turns a patched server back into a forgeable one.

Sources

• NVD: CVE-2026-55040
• Microsoft Security Update Guide
• The Hacker News, August 13, 2026