Loading vulnerability…
CVE-2026-55040 is a critical authentication bypass vulnerability in on-premises Microsoft SharePoint, affecting SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The flaw is rooted in multiple weaknesses in SharePoint's JWT token validation pipeline, including acceptance of an unsigned outer token, improper signing-key resolution from attacker-controlled token metadata, issuer validation that accepts an untrusted local signing certificate context, and a signature check that only requires a non-empty value rather than cryptographic verification. Public technical analysis identified vulnerable logic in SharePoint identity-model token handling classes and showed that an unauthenticated remote attacker can forge a JWT that SharePoint accepts as valid. By supplying a chosen identity such as a user principal name or Windows SID, the attacker can impersonate a SharePoint site user or administrator and perform authenticated operations without valid credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit for CVE-2026-55040 targeting Microsoft SharePoint. It contains only two files: a brief README and a single executable script, gettoken.py. The script uses requests to contact a target SharePoint site over HTTPS, specifically the metadata endpoint /_layouts/15/metadata/json/1, then parses the JSON response to extract the issuer value and the first certificate key blob. It computes a SHA-1 digest of the decoded certificate to derive an x5t thumbprint, constructs an actor JWT-like token, and then creates an outer unsigned token with alg set to none. The resulting token includes claims such as issuer, audience, nameid, and an embedded actortoken, enabling impersonation of an arbitrary account identity supplied via -n/--name or defaulting to c#.w|NT AUTHORITY\LOCAL SERVICE. The exploit does not deliver code execution or a shell; its main capability is authentication bypass/forged token generation for privilege impersonation against a vulnerable SharePoint deployment. The script disables TLS verification warnings and explicitly requires an HTTPS target, printing a Microsoft guidance URL otherwise. Overall, this is an operational proof-of-concept token forgery utility rather than a scanner or detection script.
Repository contains a single Python proof-of-concept exploit script and a README. The main file, CVE-2026-55040.py, targets Microsoft SharePoint authentication bypass CVE-2026-55040 by forging JWT tokens with attacker-controlled identity claims. The script supports multiple identity modes: a default LOCAL SERVICE AccessToken identity, a SID-based Active Directory identity, or a UPN-based Active Directory identity. Its workflow is: auto-discover SharePoint token-signing metadata (x5t and realm), optionally discover domain SID and enumerate RIDs via SMB/LSARPC against a domain controller to locate a valid site admin, forge a JWT, then call SharePoint to obtain a form digest for authenticated follow-on requests. The code uses curl as an external HTTP client, supports direct host-to-IP resolution overrides, inspects HTTPS certificates to derive names, and is clearly intended as an exploitation aid rather than mere detection. The README documents usage patterns and shows that successful exploitation yields authenticated access and digest retrieval, while also noting that the script stops short of implementing the final RCE chain ('Step 4: ...RCE...').
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
185 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass and impersonation vulnerability in Microsoft SharePoint caused by issues in the JWT token validation pipeline. It can allow a remote unauthenticated attacker to bypass authentication and act as a SharePoint site user or administrator, enabling file disclosure and data modification.
An authentication bypass vulnerability in SharePoint that formed part of an exploit chain leading to unauthenticated remote code execution against on-premises SharePoint servers.
Critical SharePoint authentication bypass vulnerability that formed the first part of an attack chain against on-premises SharePoint installations.
A critical authentication bypass vulnerability in Microsoft SharePoint Server Subscription Edition that allows unauthenticated remote attackers to forge JWTs and impersonate any SharePoint user, including administrators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.