Automated Cybersecurity Update

In July 2026, Microsoft released a security patch for SharePoint that addresses a high-severity vulnerability known as CVE-2026-55040. This flaw enables unauthenticated attackers to bypass authentication and perform arbitrary operations on any affected SharePoint site.

The vulnerability stems from incorrect parsing of JSON Web Token (JWT) headers during service-to-service communication within SharePoint. Attackers can exploit this by crafting JWTs with a specific header that removes the requirement for signature verification. They then embed an inner token with SharePoint's certificate thumbprint, forcing SharePoint to resolve a signing key without proper verification.

The resolved certificate allows the attacker to accept the issuer claim without question, even if it's not listed in TrustedSecurityTokenServices.

A Python proof-of-concept exploit was released by Rapid7, demonstrating how attackers can forge the JWT chain, query a target domain controller, enumerate user SIDs, and automatically identify site administrators. Since the public release, there have been twelve recorded exploitation attempts, with the majority occurring within the first two days of the patch's availability.

The impact of this vulnerability is severe. Attackers gain full read/write access to all SharePoint sites on a compromised server, allowing them to exfiltrate data, modify critical documents, inject malicious code, and potentially pivot to other internal assets. Despite not directly affecting system availability, the stealthy nature of this bypass makes detection challenging.

To mitigate this vulnerability, Microsoft strongly recommends applying the July 2026 security update as soon as possible. If patching is not feasible immediately, organizations should isolate affected SharePoint instances and restrict inbound service-to-service communication to known IP ranges. Disabling legacy JWT support in SharePoint configuration is also advised.

Security teams are encouraged to enable detailed flow logs for SharePoint endpoints, looking for anomalous JWT traffic patterns such as the use of the "alg=none" header or actor tokens with placeholder signatures. Alerts should be set up for any S2S authentication requests without valid signatures, and authentication logs should be correlated with directory services activity to spot suspicious user enumeration attempts.