The "alg: none" Trick: Four Small Flaws, Full SharePoint Admin

Overview: What is Happening?

Threat actors are actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint (CVE-2026-55040, CVSS 9.1), originally patched in the July 2026 Patch Tuesday update. The spike in malicious activity — tracked closely since mid-July — surged on August 12 and 13 following the public release of a proof-of-concept (PoC) exploit. This flaw allows an unauthenticated remote attacker to sidestep authentication and impersonate any SharePoint user, including site administrators. While the vulnerability does not impact system availability, it grants full capability to disclose and modify sensitive data. Organizations running on-premises SharePoint must prioritize patching immediately to prevent unauthorized administrative access and data breaches.

Technical Deep Dive: Dissecting CVE-2026-55040

To properly assess the risk, we need to look under the hood of how this authentication bypass works and how it is being weaponized in the wild.

What Exactly is the Vulnerability?

CVE-2026-55040 is a logical flaw residing in the JSON Web Token (JWT) validation pipeline used for Bearer service-to-service (S2S) tokens in SharePoint. Specifically, it involves token parsing and validation weaknesses within two core classes: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.

Rather than a single massive failure, the vulnerability is a chain of four distinct validation oversights that, when combined, allow an attacker to forge a completely valid JWT from scratch.

The Exploit Chain Explained

To successfully exploit the system, an attacker manipulates the token logic in four sequential steps:

1. Algorithm Confusion: The attacker sends a JWT with the outer header set to "alg: none". This instructs the SharePoint server that no cryptographic signature is required for the outer token.
2. Key Resolution Bypass: The actor token’s x5t header is injected with SharePoint’s own Security Token Service (STS) certificate thumbprint. This tricks the system into resolving a signing key without actually verifying it.
3. Issuer Acceptance: The resolved certificate intentionally falls outside the TrustedSecurityTokenServices store. Ironically, this specific condition forces the token parsing logic to accept the issuer.
4. Ignored Signature: A dummy, non-empty signature (e.g. “AAAA”) is appended to the actor token. Because of the previous logical flaws in the pipeline, this forged signature is never mathematically verified.

The Public Proof-of-Concept (PoC)

The catalyst for the recent spike in active exploitation was a Python-based PoC released by researchers at Rapid7 earlier this week (August 2026).

The Rapid7 PoC automates the attack seamlessly. It uses the forged JWT to query the target’s Domain Controller, enumerating users by their Security Identifiers (SIDs). The script then auto-locates the SID of a SharePoint site administrator, instantly granting the unauthenticated attacker full administrative impersonation capabilities. Following this release, threat intelligence platforms detected a sharp increase in exploitation attempts originating from IP addresses across the U.S., the Netherlands, Japan, Taiwan, and Hong Kong.

The GRC & Risk Perspective

For Governance, Risk, and Compliance (GRC) professionals, the risk profile here is critical.

• Confidentiality & Integrity Impact: While system availability remains untouched (meaning no immediate denial of service or ransomware lockouts to alert you), the confidentiality and integrity of your data are entirely compromised. Attackers can quietly read sensitive files, alter financial or proprietary records, and establish stealthy persistence.
• Action Items: This is no longer a theoretical risk; it is an active, weaponized threat. Security and IT teams must enforce emergency patch deployment for the July 2026 Microsoft updates and proactively review SharePoint and Domain Controller audit logs for suspicious SID enumeration activities.