sharepointcve-2026-55040authentication-bypassjwtmsft

Critical SharePoint JWT Authentication Bypass CVE-2026-55040 Exploited in the Wild

A critical authentication bypass (CVE-2026-55040) in Microsoft SharePoint allows unauthenticated attackers to impersonate users and admins, with active exploitation reported across multiple regions.

Diego Diaz
7 min

What Happened

On August 13, 2026, threat actors began exploiting a newly disclosed Microsoft SharePoint vulnerability, identified as CVE-2026-55040, with a CVSS score of 9.1. The flaw resides in the JSON Web Token (JWT) validation pipeline, allowing unauthenticated attackers to bypass authentication and gain administrative privileges The Hacker News.

Technical Analysis

The vulnerability is rooted in four chained weaknesses within the SharePoint JWT handling code. First, the token validation routine disables the requirement for a cryptographic signature. Second, an attacker‑controlled certificate thumbprint (x5t) is resolved against SharePoint’s own Security Token Service (STS) certificate without verification. Third, issuer validation accepts unregistered certificates, and fourth, the final signature check only verifies that the field is non‑empty, not that it is cryptographically valid. These weaknesses allow a forged token to be accepted as legitimate, granting the attacker the ability to impersonate any SharePoint user, including site administrators Rapid7 Technical Analysis.

Who’s Affected

The flaw impacts on‑premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Shadowserver tracks over 8,500 publicly exposed SharePoint installations, many of which remain unpatched despite Microsoft’s July 2026 Patch Tuesday release. Exploitation attempts have been recorded from at least eight unique IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the United States, with twelve total attempts since mid‑July, eight of which occurred on August 12‑13 alone TechTimes.

How to Protect Yourself

  • Apply Microsoft’s July 2026 Patch Tuesday update immediately to remediate CVE-2026-55040.
  • Restrict direct internet exposure of SharePoint servers; place them behind a Layer 7 reverse proxy that enforces authentication and inspects traffic.
  • Implement strict JWT validation policies: require signed tokens, validate issuer chains, and enforce certificate pinning for STS certificates.
  • Monitor authentication logs for anomalous token usage and unauthorized admin actions.
  • Leverage threat‑intelligence feeds (e.g., CISA, Defused) to stay aware of emerging exploits.

The Sable Angle

At Sable, we routinely assess SharePoint environments for misconfigurations and exploitability. Our offensive security team can simulate the JWT bypass chain to validate defenses and provide tailored hardening recommendations. Learn more about our SharePoint security audit services here and explore how Sable’s platform can automate continuous monitoring for similar authentication‑bypass patterns.