SharePoint JWT/S2S authentication bypass
This is a public-source synthesis. The technical picture below is Rapid7’s analysis of CVE-2026-55040, plus follow-on reporting. I did not independently reverse SharePoint’s JWT/S2S pipeline, and I did not run the PoC.
If you run on-prem SharePoint, patch first. The rest is context.
Summary
CVE-2026-55040 is an unauthenticated JWT/S2S authentication bypass in on-premises Microsoft SharePoint. Rapid7 and Microsoft disclosed it on 14 July 2026. Rapid7 published a technical analysis and PoC on 11 August 2026 showing a remote attacker can forge a Bearer token and operate as a site user or administrator (Rapid7). Rapid7’s writeup is based on SharePoint Server Subscription Edition.
On 12 August 2026, SecurityWeek reported that Defused honeypots recorded exploitation attempts using that public PoC. That is the in-the-wild claim I am repeating — honeypot hits after a PoC, not a victim-incident writeup I have independently confirmed. SecurityWeek also noted Microsoft’s advisory had not yet listed exploitation at the time of that report.
Attack vector
Internet- or network-reachable SharePoint HTTP(S) accepting Authorization: Bearer via SPApplicationAuthenticationModuleV2. Unauthenticated GET /_layouts/15/metadata/json/1 returns the local STS cert and actor-token x5t; no credentials required (Rapid7).
Exploit
Broken nested S2S JWT validation in Microsoft.SharePoint.IdentityModel accepts an unsigned outer token (alg:none) and skips actor RSA checks after x5t resolves to the farm STS cert, mapping attacker nameid (SID or UPN) to a site user or admin (Rapid7).
Risk
Impersonation of any resolvable site user or administrator, then authenticated REST/CSOM after a FormDigest (Rapid7).
Remediation
Apply Microsoft’s July 2026 fix for CVE-2026-55040 on versions Microsoft lists as affected. Rapid7’s analysis is Subscription Edition; I am not restating a SKU matrix I did not open. Until patched, restrict SharePoint to trusted networks, treat /_layouts/15/metadata/json/1 as sensitive, and require reverse-proxy auth for /_api/* and /_layouts/* where you can.
Hunt guidance below is compressed from Rapid7’s public analysis, not from a lab I ran: unauthenticated metadata hits, then Bearer tokens with outer alg:none, actor x5t matching the farm STS thumbprint and a trivial signature, then unexpected /_api/web/currentuser or /_api/contextinfo success. Confirm patched IdentityModel rejects unsigned outer tokens.