SharePoint in CVE alert 2026 55040 JWT failures allow for identity supplanting and data exfiltration

In recent weeks malicious activity has been detected taking advantage of a critical vulnerability in Microsoft SharePoint registered as CVE-2026-55040(CVSS 9.1), which Microsoft corrected in its July 2026 patch package. The company described the failure as a weakness of authentication that allows supplanting; in concrete terms, an attacker without valid credentials can circumvent controls and act with the privileges of a site user or administrator, with the ability to read and modify data although, according to Microsoft, not to affect the availability of the service. The official Microsoft entry on the CVE summarizes the gravity and scope of the patch.

Technically, the documented operation combines errors in the JWT (JSON Web Tokens) tokens validation chain used by SharePoint for service-to@-@ service authentication. Independent researchers - including Rapid7 - have published an analysis and a concept test that chain several weaknesses in the token handlers (identified as SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2) to forge a valid JWT without having the legitimate signature key. The key technical vector is the abuse of a nested "actor" token: the attacker sends an external token with "alg: none" (which eliminates signature verification at the first level), includes as a key identifier (x5t) the thumbprint of SharePoint's own STS certificate and adds a false signature to the internal token that never comes to be verified. In this way the application accepts the forged identity and allows requests with the context of a real user.

The practical effects demonstrated by Rapid7 PoC are significant: with a forged token you can consult the target domain controller, list users from your SID and automatically locate accounts with management privileges on a SharePoint site. This places vulnerability as a facilitator for exfiltration of information and for lateral climbing in corporate environments that rely on these tokens for inter-service delegation. To better understand how the standards involved work, the JWT specification is a useful reference: RFC 7519 on JSON Web Token.

The facts confirmed so far include the release of the patch by Microsoft in July, public release of PoC by researchers, and detections of real-world exploitative attempts. According to telemetry cited by analysts (KEVIntel), 12 attempts at exploitation were recorded since 19 July 2026, with a peak of eight attempts on 12 and 13 August, suggesting that the availability of the test code has accelerated activity. The connections come from IP addresses grouped in at least five different jurisdictions - including Hong Kong, Japan, the Netherlands, Taiwan and the USA - which indicates distributed activity but does not allow it to be attributed to a particular actor; the motivation (espionage, data theft, post-deployment) is not yet confirmed.

It is important to separate the confirmed from the estimated. It is established that PoC exists and that attempts to operate have been observed; it is reasonable to estimate that groups with interest in corporate data or web infrastructure will prioritize targets with SharePoint exposed and unpatched. What remains uncertain is the identity of the actors that are carrying out the intrusions, their final objectives and whether they have already been able to compromise large-scale productive environments. Until there is evidence of sophisticated intrusions that attribute specific objectives (e.g. mass data theft or ransomware deployment linked to this CVE), any conclusion on the actual scope remains as a hypothesis.

For managers and security officials, the most urgent and concrete recommendation is apply Microsoft patch without delay to all affected SharePoint servers. If for operational reasons it is not possible to update immediately, there are mitigating measures that reduce exposure: limit network access to SharePoint instances from external networks and from segments that do not require S2S communication, block or inspect traffic to endpoints that accept tokens Bearer and deploy WAF rules that detect tokens with "alg" header: "none" or unusual patterns in the x5t field. The list of "TrustedSecurityTokenServices" should also be reviewed and STS certificates rotated where feasible.

In terms of detection and response, organizations should look for concrete indicators in their records: HTTP requests with Authentication headers containing JWTs with decoding header base64 showing "alg": "none," STS thumbprint appearances in external tokens, unusual SharePoint access to domain controllers or administrative APIs consultations conducted by accounts that should not execute these actions. Monitoring IIS, SSharePoint's ULS and domain security records, and setting alerts for IID user listing and access to product administrative routes, will allow you to detect early attempts. If commitment is suspected, disable the affected accounts, force the restoration of credentials and review integrity of configurations and content are recommended steps.

Finally, it is necessary to adopt in-depth defence measures in the medium term: strengthening authentication (MFA for administrative accounts and services with lifting), segmentation of networks between S2S services, applying less privileged principles to service accounts, and reviewing the life cycle of tokens and certificates in order to be able to revoke and rotate quickly to incidents. For teams that need more technical context on the nature of these PoC attacks and analysis, security firm research blogs are useful resources for deepening: Rapid7 Research publishes technical analyses and demonstrations that help understand concrete vectors and mitigations.

In short, vulnerability CVE-2026-55040 allows for supplanting by handling JWT validation and is already being exploited in attempts detected in at least five regions. Plot immediately the authorities concerned are the priority measure; if not possible, apply network controls, tokens inspection and focused monitoring reduces the risk until the official correction can be deployed. The evidence available confirms attempts at abuse and shows that the release of test code often accelerates activity, but the attribution and final scope of incidents remain to be confirmed.