CVE-2026-55040 JWT Forgery Chain Exploited in 12 SharePoint Attempts Post-Rapid7 PoC
CVE-2026-55040 exploitation spiked after Rapid7 published a PoC chaining JWT validation flaws in SharePoint token handlers. Twelve attempts from five countries were logged, continuing a 2026 pattern of rapid abuse of Microsoft authentication bypasses. Patching and log monitoring for anomalous JWTs are required; similar risks exist in other enterprise platforms.
The vulnerability chains four weaknesses in SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2: an outer JWT with alg:none, an actor token x5t matching SharePoint's own STS certificate without TrustedSecurityTokenServices verification, an unvalidated non-empty signature, and issuer acceptance despite missing trust. This allows forged tokens that query domain controllers, enumerate SIDs, and impersonate site administrators.
KEVIntel telemetry recorded eight of the twelve attempts on August 12-13 immediately after the PoC drop, confirming the typical public-exploit-to-active-use window. The flaw is the fifth SharePoint authentication bypass exploited in 2026 after CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522, revealing a persistent pattern in Microsoft's S2S token validation classes.
Microsoft's advisory understates impact by limiting description to file disclosure and data modification, while the technical chain grants full administrator operations. Procurement records and patch deployment data for on-premise SharePoint instances show slower update cycles than cloud tenants, leaving the same token pipeline exposed across multiple years of releases.
Unpatched servers will face continued scanning and exploitation; similar JWT validation gaps observed in SAP Commerce Cloud S2S flows indicate the pattern is not isolated to Microsoft products and will recur without architecture-level changes to token trust enforcement.
KEVIntel: Exploitation attempts will exceed 40 by September 15 2026 if patching rates remain below 60 percent of on-premise deployments.
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html)
- [2]Supporting Source(https://www.rapid7.com/blog/post/2026/08/cve-2026-55040-sharepoint-jwt-bypass/)