A Four-Link JWT Chain, a Public PoC, and a July SharePoint Patch Nobody Finished Applying

Rapid7 published a Python proof-of-concept on August 12 for CVE-2026-55040, a critical SharePoint authentication bypass Microsoft fixed in its July 2026 Patch Tuesday ^{[1][2][3][11]}. Of the 12 exploitation attempts KEVIntel has logged since July 19, eight occurred on August 12 and 13, according to telemetry reported by The Hacker News ^[12][13].

The flaw carries a CVSS score of 9.1 and lets an unauthenticated remote attacker impersonate any SharePoint site user, including an administrator ^[2][4]. Rapid7 describes the root cause as a chain of four distinct weaknesses in the JWT token validation pipeline of SharePoint Server Subscription Edition, in the two classes that parse and validate Bearer service-to-service tokens, SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 ^[5][6].

The chain is not subtle. The attacker sends a JWT with "alg: none" in the outer header, so the outer token needs no signature at all ^[7]. The inner actor token's x5t header carries SharePoint's own STS certificate thumbprint, which lets the server resolve a signing key with no verification ^[8]. That resolved certificate is not in TrustedSecurityTokenServices, which is what allows the issuer to be accepted ^[9]. Finally, the actor token's signature can be any non-empty value, such as "AAAA," because it is never checked ^[10]. Four separate places where a check was optional, chained into a forged token the server treats as legitimate.

Rapid7's PoC does not stop at forging the token. It uses it to query the target's domain controller, enumerate users by SID, and automatically locate a site administrator ^[11]. That is the part that turns a validation bug into an operational problem: the tooling finds the privileged account for you.

Microsoft's advisory frames the impact narrowly. The vulnerability allows impersonation, and an attacker could disclose files and modify data, but cannot affect system availability ^[14]. For a document platform holding a farm's worth of business records, read and write is most of the loss.

Two caveats on the telemetry, since both stories rest on it. Defused Cyber reports observing attackers using Rapid7's PoC against its honeypots, which means the confirmed activity is against decoys rather than named victims ^[15]. And exploitation did not begin with the PoC: subtracting the August 12 to 13 cluster from the total leaves four attempts spread across the roughly 24 days from July 19 to August 11 ^[17][18]. The PoC did not open the window. It concentrated the traffic through it, at a rate of about four attempts per day versus roughly one every six days before ^[19]. The 12 attempts came from eight unique IP addresses in five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan and the United States ^[16]. Attribution and intent are unknown ^[20].

The remediation has existed since July ^[3]. Anyone who has not applied that update is directly exposed ^[21]. Twelve attempts is a small number, and it will not stay small if the patch rate does not move.

What to watch: whether the attempt count keeps climbing now that the automation is on GitHub ^[11][12], whether any named victim organisation surfaces to replace honeypot sightings ^[15], and whether Subscription Edition farms that were assumed patched in July turn out to have been missed. If you cannot confirm the July update on every SharePoint farm you own, treat that as unpatched.