Executive Summary
A critical authentication bypass vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-55040 (CVSS 9.1), has entered a phase of aggressive, active exploitation in the wild. This surge follows the public release of a functional proof-of-concept (PoC) exploit framework.
Originally patched in July 2026, the vulnerability resides in SharePoint’s internal Security Token Service (STS) JSON Web Token (JWT) validation pipeline. The availability of weaponized Python exploit code has triggered scanning and exploitation activity originating from threat actors in Hong Kong, Japan, Taiwan, the Netherlands, and the United States. Unauthenticated remote attackers are actively leveraging this flaw to forge valid administrative tokens, bypass identity perimeters, and exfiltrate or modify sensitive corporate files across entire SharePoint farms.
Vulnerability ID
CVSS Score
Affected Component
Patch Date
CVE-2026-55040
9.1 (Critical)
Security Token Service (STS)
July 2026
Deep-Dive Technical Analysis
The vulnerability stems from a compounding chain of four distinct flaws within the JWT token parsing and validation routines of SharePoint Server Subscription Edition and on-premises installations. These flaws allow unauthenticated attackers to construct a forged, untrusted JWT that the server accepts as a legitimate identity assertion.
Exploit Chain and Token Forgery Mechanics
1. Outer Header Algorithm Stripping: Attackers craft a nested or dual-wrapped JWT and set "alg": "none" in the outer token header. This tricks the token handler into skipping cryptographic signature checks on the outer envelope.
2. STS Certificate Thumbprint Spoofing: Within the inner actor token, the attacker sets the x5t (X.509 certificate SHA-1 thumbprint) header to match the internal thumbprint of SharePoint's own Security Token Service (STS) certificate.
3. Trust Validation Bypass: Due to a logic flaw in how certificate thumbprints are evaluated against TrustedSecurityTokenServices, the token handler accepts the resolved signing key without confirming whether the issuing authority is trusted for external claims.
4. Signature Verification Omission: The attacker supplies a dummy signature string (e.g., AAAA) for the actor token. Because of improper branching in the signature verification module, the parser evaluates the presence of a non-empty signature as satisfied without verifying its mathematical validity against the public key.
5. SID Enumeration and Impersonation: Once the forged JWT is accepted, the exploit script queries the target Active Directory or local directory services via Security Identifier (SID) lookups to resolve administrative SIDs. The attacker then injects administrative SID claims into subsequent requests, granting complete read, write, and data modification privileges.
Industry Impact and Recommendations
Strategic & Operational Impact
SharePoint is a foundational repository for enterprise document management, intellectual property, and compliance records across government, healthcare, defense, and financial sectors. Unauthenticated administrative access enables threat actors to exfiltrate proprietary source code, legal agreements, and PII, or manipulate internal documents to compromise organizational integrity.
Mitigation Strategies
* Apply Official Vendor Patches Immediately: Organizations running on-premises SharePoint Server Subscription Edition or supported legacy versions must immediately verify and enforce the installation of Microsoft's July 2026 security updates.
* Enforce WAF and API Perimeter Rules: Configure Web Application Firewalls (WAF) to inspect inbound HTTP headers and block requests containing JWTs with "alg": "none" or unverified x5t thumbprint mappings.
* Implement Zero Trust Architecture (ZTNA): Remove direct public internet access from on-premises SharePoint endpoints. Force all inbound connections through authenticated ZTNA gateways or strict VPN tunnels.
* Log Auditing and Threat Hunting: Audit IIS web server logs and SharePoint ULS (Unified Logging Service) logs for anomalous POST requests to / _vti_bin/ / _api/ endpoints and rapid automated SID enumeration queries from unfamiliar IP addresses.
Sources: The Hacker News — Attackers Exploit SharePoint Authentication Bypass, SecurityAffairs — SharePoint CVE-2026-55040 Comes Under Attack