Microsoft SharePoint Server JWT Token Authentication Bypass — CVE-2026-55040 (Unauthenticated Impersonation via Forged Actor Token)

Indicators

• Unauthenticated HTTP requests to SharePoint with Authorization: Bearer <JWT> header succeeding as an arbitrary site user or administrator
• SharePoint requests carrying a nested JWT containing an 'actortoken' claim from untrusted or unexpected source IPs
• Administrative or user actions performed on SharePoint sites with no corresponding interactive/federated authentication event in logs
• Call stack in w3wp.exe reaching SPJsonWebSecurityTokenHandlerV2.ValidateToken from SPApplicationAuthenticationModuleV2.TryExtractAndValidateToken for anonymous callers
• Traffic patterns matching Rapid7 Labs published proof-of-concept for CVE-2026-55040

Likely causes

• Chain of four distinct weaknesses in SharePoint's JWT token validation pipeline within Microsoft.SharePoint.IdentityModel.dll
• Improper validation of the nested 'actor token' embedded in the actortoken claim of the outer JWT, allowing forged tokens to bypass signature verification
• Flaws in SPJsonWebSecurityTokenHandlerV2.ValidateToken() and SPJsonWebSecurityBaseTokenHandlerV2.ReadToken() permitting trust decisions on attacker-controlled token fields before cryptographic verification against a trusted certificate

Diagnostic steps

1. Run the following PowerShell on each SharePoint server to identify the current build: (Get-SPFarm).BuildVersion
   Determine whether the farm is running the vulnerable build (16.0.19725.20210 or earlier unpatched equivalent) compared to the patched July 14, 2026 release.
2. Inventory all SharePoint front-end web servers exposing endpoints that accept Bearer tokens via the Authorization header. Check IIS bindings and firewall rules to confirm external reachability.
   Establish the external attack surface for the JWT authentication bypass vulnerability.
3. Review IIS logs (typically C:\inetpub\logs\LogFiles) for requests containing 'Authorization: Bearer' headers from unusual source IPs or without prior federated authentication traffic. Use LogParser or grep: findstr /i "Bearer" u_ex*.log
   Detect potential exploitation attempts leveraging forged JWTs against SPApplicationAuthenticationModuleV2.TryExtractAndValidateToken().
4. Correlate SharePoint audit logs (site/administrative actions via Site Settings > Audit log reports) with Entra ID/ADFS authentication logs to identify actions performed by identities lacking a corresponding valid sign-in event.
   Identify possible impersonation via forged actor tokens indicating active exploitation.
5. On a non-production SharePoint instance mirroring production patch level, run the Rapid7 Labs published proof-of-concept for CVE-2026-55040 to confirm exploitability.
   Validate that the vulnerable code path is exercisable in your environment prior to patch deployment.
6. During a suspected exploit attempt, capture a w3wp.exe process dump using procdump -ma <PID> or attach WinDbg. Examine the call stack for SPJsonWebSecurityTokenHandlerV2.ValidateToken being reached without legitimate signing certificate validation.
   Provide forensic confirmation that the vulnerable code path in Microsoft.SharePoint.IdentityModel.dll is being exercised by an attacker.

Resolution path

• Download and apply the Microsoft security update for SharePoint Server Subscription Edition that addresses CVE-2026-55040 (released July 14, 2026) to all farm servers.
• After patching binaries on every server, run the SharePoint Products Configuration Wizard: PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
• Restart IIS on each server: iisreset /restart
• Restart the SharePoint Timer Service on each server: Restart-Service SPTimerV4
• Rotate any SharePoint S2S trust certificates and application principal secrets that may have been exposed, since forged tokens could have been minted without possession of the legitimate signing certificate.
• Review and restrict external exposure of SharePoint endpoints accepting Bearer S2S tokens by placing them behind a reverse proxy or WAF capable of inspecting Authorization headers.

Prevention

• Enroll SharePoint Server Subscription Edition farms in a monthly patch cadence tied to Microsoft's Patch Tuesday releases so critical IdentityModel fixes deploy within days of release.
• Restrict Internet exposure of SharePoint endpoints accepting Bearer S2S tokens; require them to sit behind an authenticated reverse proxy or WAF that can inspect and constrain Authorization: Bearer traffic.
• Rotate SharePoint S2S signing certificates and application principal secrets on a defined schedule and immediately after any suspected exposure.
• Enable and centrally collect SharePoint ULS and IIS logs, alerting on unusual Bearer token authentication patterns and identity claims used without a matching federated sign-in event.
• Maintain a non-production SharePoint farm at the same patch level as production to safely validate vulnerability PoCs before and after patching.

Tools

• Rapid7 Labs PoC script for CVE-2026-55040 (exploit validation)
• SharePoint Products Configuration Wizard / PSConfig (post-patch farm upgrade)
• IIS Manager and IIS logs (Authorization header inspection)
• SharePoint ULS Viewer (authentication and token validation diagnostics)
• WinDbg / procdump (process dump capture)
• dnSpy / ILSpy (decompilation of Microsoft.SharePoint.IdentityModel.dll)
• Web Application Firewall / reverse proxy (Bearer token filtering)
• LogParser (IIS log analysis)

References

• Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)