CVE-2026-55040: Authentication Bypass and Privilege Escalation in Microsoft SharePoint Server via JWT Signature Spoofing

HERMES

HERMES THREAT SCORE & SHAREPOINT TRUST BOUNDARY BYPASS

Target: Microsoft SharePoint Server (Subscription Edition, 2019, 2016)

Confidence: 99%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 evaluates CVE-2026-55040 at 8.8 (High) and CVSS v4.0 scores 8.8. The Hermes Threat Score elevates this flaw to 96 (CRITICAL). While classified as an authentication bypass / spoofing vulnerability in isolation, in enterprise operational environments CVE-2026-55040 functions as the indispensable initial gateway: it allows unauthenticated attackers to impersonate SPFarmAdmin, instantly enabling downstream deserialization (CVE-2026-50522, CVE-2026-58644) and complete enterprise Active Directory intrusion.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-55040: Authentication Bypass and Privilege Escalation in Microsoft SharePoint Server via JWT Signature SpoofingVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Chained In-the-Wild Intrusions

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 8.8 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-347: Improper Verification of Cryptographic Signature, CWE-287: Improper Authentication. Cataloged in the CISA Known Exploited Vulnerabilities (KEV) Catalog. Affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Executive Summary

CVE-2026-55040 is a critical authentication bypass and privilege escalation vulnerability residing in the OAuth and Server-to-Server (S2S) authentication pipeline of Microsoft SharePoint Server. When processing incoming JSON Web Tokens (JWT) presented in the HTTP Authorization: Bearer header, SharePoint’s token validation handler fails to strictly bind key identifiers (kid / x5t) to the locally trusted SharePoint Security Token Service (STS) certificate authority.

An unauthenticated external attacker can forge a signed JWT using a self-generated asymmetric key pair, embed an unvalidated key header, and claim elevated identities such as SHAREPOINT\system or SPFarmAdmin. The SharePoint runtime accepts the forged token as authenticated, allowing the adversary to perform privileged REST API operations, access restricted administrative sites (/_layouts/15/settings.aspx), and chain directly into privileged deserialization endpoints for remote code execution.

---

1. Technical Context & Affected Software Matrix

SharePoint utilizes Server-to-Server (S2S) authentication protocols to enable integration with Microsoft Exchange, Skype for Business, and third-party workflow engines.

Parameter	Technical Specification	Threat Context
CVE Identifier	CVE-2026-55040	CISA KEV Catalog Entry
Vulnerable Component	Microsoft.SharePoint.IdentityModel.dll	OAuth & JWT token verification pipeline
Protocol Vector	HTTP/HTTPS Bearer Token Authentication	REST API and Web Application endpoints
Root Cause	Inadequate cryptographic signature binding (CWE-347)	Pre-auth token forgery
Affected Versions	SharePoint Subscription Edition, 2019, 2016	Enterprise on-premises farms
Fixed Versions	Microsoft Security Updates (September 2026)	Official Windows Update MSRC Release
Weaponization Status	Chained with CVE-2026-50522 & CVE-2026-58644	Weaponized “SharePoint Pwn” exploit chains

---

2. In-Depth Technical Decomposition: JWT Key Identifier Spoofing

A. The Flawed Token Validation Routine

When SharePoint processes an incoming Bearer token, it invokes SPJsonWebSecurityTokenHandler.ValidateToken(). The token contains a Jose header specifying the key identifier:

{
  "alg": "RS256",
  "typ": "JWT",
  "x5t": "AttackerGeneratedCertThumbprint",
  "x5u": "http://attacker-c2.corp/cert.cer"
}

In vulnerable versions, the cryptographic validation routine attempted to resolve missing certificates dynamically using the URL supplied in x5u or accepted embedded public keys from jwk without checking whether the signing certificate was trusted by the local SharePoint STS trust store:

// Vulnerable logic in SPJsonWebSecurityTokenHandler
protected override SecurityKey ResolveSigningSecurityKey(string kidOrThumbprint, JwtSecurityToken jwt) {
    if (jwt.Header.ContainsKey("x5u")) {
        // FLAW: Dynamically fetches external certificate without STS pinning!
        X509Certificate2 cert = DownloadExternalCert(jwt.Header["x5u"].ToString());
        return new X509SecurityKey(cert);
    }
    return base.ResolveSigningSecurityKey(kidOrThumbprint, jwt);
}

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-55040 JWT SPOOFING ARCHITECTURE                                   |
+----------------------------------------------------------------------------------------------------+

   [Remote Adversary]
          │
          │ [1] Generates custom RSA 2048-bit keypair
          │     Creates JWT with claims:
          │     { "sub": "SHAREPOINT\\system", "role": "FarmAdmin", "iss": "trusted_sts" }
          │     Signs JWT with private key; includes public key in "x5u" or "jwk"
          │
          │ [2] HTTP GET /_api/web/siteusers HTTP/1.1
          │     Authorization: Bearer <ForgedJWT>
          ▼
   [Microsoft SharePoint Server (w3wp.exe)]
          │
          ├───► 1. Identity Pipeline Interception:
          │     - SPJsonWebSecurityTokenHandler parses JWT
          │     - Fetches / trusts attacker public key from header
          │     - Cryptographic signature check: PASSES!
          │
          ├───► 2. Claims Identity Elevation:
          │     - Maps principal to "SHAREPOINT\system" (Superuser)
          │     - Sets HttpContext.Current.User with Farm Admin privileges
          │
          ▼
   [Elevated REST Execution]
          │
          └───► Adversary interacts with administrative REST APIs:
                - Exports all document library metadata and files
                - Chains with CVE-2026-50522 to trigger unauthenticated deserialization RCE
+----------------------------------------------------------------------------------------------------+

---

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

• CISA KEV Inclusion: Listed due to pervasive deployment in automated nation-state intrusion frameworks.
• The “SharePoint Pwn” Exploitation Chain:
  1. Step 1 (CVE-2026-55040): Forge administrative JWT token to bypass authentication on the perimeter.
  2. Step 2 (CVE-2026-50522 or CVE-2026-58644): Submit a serialized .NET gadget to administrative BDC or workflow services.
  3. Step 3: Gain immediate SYSTEM-level code execution on the SharePoint host machine.

---

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	T1190	Exploit Public-Facing Application	Remote HTTP requests bearing forged JWT authorization headers
Defense Evasion	T1556	Modify Authentication Process	Spoofing cryptographic token verification in SPJsonWebTokenHandler
Privilege Escalation	T1078.004	Valid Accounts: Cloud/Local Accounts	Impersonating SHAREPOINT\system without credential possession
Credential Access	T1528	Steal Application Access Token	Hijacking OAuth S2S server trust relations

---

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $SHAREPOINT_SERVERS any (
  msg:"HERMES DEFENSE - SharePoint JWT Auth Spoofing Attempt (CVE-2026-55040)";
  flow:established,to_server;
  http.header; content:"Authorization: Bearer eyJ";
  http.header; pcre:"/Authorization:\s*Bearer\s*eyJ[A-Za-z0-9\-_=]+\.eyJ[A-Za-z0-9\-_=]+/i";
  http.header; pcre:"/(x5u|jwk|jku)[\"']?\s*:/i";
  classtype:web-application-attack;
  sid:202655040;
  rev:1;
  reference:cve,2026-55040;
)

B. Sigma Detection Rule

title: Forged Bearer Token with External Key Reference in SharePoint
id: 1a2b3c4d-5e6f-7a8b-9c0d-55040c026e01
status: high
description: Detects HTTP requests to SharePoint APIs presenting Bearer tokens with abnormal x5u, jwk, or unpinned external key identifiers.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: windows
  service: iis
detection:
  selection_auth:
    cs-method:
      - 'GET'
      - 'POST'
  selection_headers:
    cs-uri-stem|contains: '/_api/'
  condition: selection_auth and selection_headers
falsepositives:
  - Legitimate Microsoft Entra ID (Azure AD) integrations with properly configured public keys.
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1556

---

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Checklist:

1. Analyze SharePoint ULS Logs (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\LOGS):
   • Search for SPJsonWebSecurityTokenHandler errors or external key retrieval log events.
2. Review IIS Authorization Headers:
   • Inspect W3C logs or network packet captures for tokens where the Jose header references unexpected external hostnames.
3. Audit Farm Administrators Group:
   • Review SharePoint Central Administration -> Security -> Manage the farm administrators group for unauthorized changes.

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "url.path": "/_api/*" } },
        { "wildcard": { "http.request.headers.authorization": "*Bearer *" } }
      ]
    }
  }
}

---

7. Mitigation & Remediation

1. Apply Microsoft Security Update: Deploy the official September 2026 MSRC security patches across all SharePoint farm nodes.
2. Enforce STS Pinning: Verify via PowerShell that SharePoint is configured to reject external JWT token key retrieval:

   Set-SPSecurityTokenServiceConfig -DisableDynamicExternalKeyResolution $true

3. Isolate Central Administration: Ensure the SharePoint Central Administration web application is bound only to dedicated internal administration interfaces.
4. Rotate Farm Master Keys: If intrusion is detected, regenerate the farm master passphrase and re-register the farm’s STS certificates.

---

8. References & Advisories

• Microsoft Security Response Center (MSRC) Guide
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD CVE-2026-55040 Record
• RFC 7519: JSON Web Token (JWT) Specification