Loading vulnerability…
CVE-2026-55040 is a critical weak-authentication vulnerability in the JSON Web Token validation pipeline of on-premises Microsoft SharePoint Server. Insufficient validation in the SharePoint token handlers, including SPJsonWebSecurityTokenHandlerV2, permits acceptance of attacker-forged JWTs. The bypass involves weaknesses affecting unsigned outer tokens, certificate-thumbprint handling, issuer validation, and embedded-token signature validation. A remote unauthenticated attacker can forge a token for a known SharePoint user and have it accepted as authenticated.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
The repository contains a README and one standalone Python exploit, poc.py; it is not a Metasploit, Nuclei, or other framework module. The script implements a claimed unauthenticated SharePoint RCE chain against CVE-2026-55040 and CVE-2026-63520. First, it requests public SharePoint STS metadata to recover the token realm and calculate an x5t value from the advertised signing certificate. It also performs optional NTLM and TLS-certificate reconnaissance to identify target naming information. It then constructs nested JWTs: an unsigned outer token (alg:none) that carries a selected user identity and an inner RS256-formatted actor token with a non-empty dummy signature and the recovered x5t. The README and code identify SID, UPN, and limited AccessToken identity modes; optional impacket-assisted domain-SID discovery is available through --domain-ip. After confirming access, the script generates a malicious BDCM XML model, creates a BusinessDataMetadataCatalog location, uploads the model, refreshes SharePoint request digests, and invokes ProcessQuery to cause BDC unsafe type resolution. The intended gadget is System.Windows.Data.ObjectDataProvider, configured to call Process.Start on a user-controlled executable and argument string. This yields arbitrary command execution under the SharePoint service/application-pool identity. The command is configurable through --cmd, while --check-only stops after authentication-bypass validation.
The repository contains one standalone Python 3 exploit script, CVE-2026-55040.py (approximately 29 KB), with no identified exploitation framework dependency. It implements an end-to-end claimed Microsoft SharePoint authentication-bypass-to-RCE chain. The script first discovers token inputs such as realm and x5t from SharePoint STS metadata and attempts identity discovery through optional impacket SMB/LSARPC SID/RID enumeration; alternatively, it accepts a UPN/SID or uses a local-service identity fallback. It then creates an alg:none JWT containing a trustedfordelegation-style claim, uses that token to call SharePoint's context-info REST API for a request digest, uploads a C# ASPX command shell using SharePoint REST file operations, and requests the shell with a configurable command. HTTP is implemented with Python standard-library sockets/http.client and deliberately disables TLS certificate verification; it also supports an IP override while retaining a target hostname in Host/SNI. The script is operational rather than merely a detector because it includes a deployable webshell and arbitrary command execution. The source comment references a different CVE (CVE-2026-63520) than the script name/claimed target (CVE-2026-55040), so the claimed CVE association should be independently validated before relying on it.
This repository is a small standalone Python exploit for CVE-2026-55040 targeting Microsoft SharePoint. It contains only two files: a brief README and a single executable script, gettoken.py. The script uses requests to contact a target SharePoint site over HTTPS, specifically the metadata endpoint /_layouts/15/metadata/json/1, then parses the JSON response to extract the issuer value and the first certificate key blob. It computes a SHA-1 digest of the decoded certificate to derive an x5t thumbprint, constructs an actor JWT-like token, and then creates an outer unsigned token with alg set to none. The resulting token includes claims such as issuer, audience, nameid, and an embedded actortoken, enabling impersonation of an arbitrary account identity supplied via -n/--name or defaulting to c#.w|NT AUTHORITY\LOCAL SERVICE. The exploit does not deliver code execution or a shell; its main capability is authentication bypass/forged token generation for privilege impersonation against a vulnerable SharePoint deployment. The script disables TLS verification warnings and explicitly requires an HTTPS target, printing a Microsoft guidance URL otherwise. Overall, this is an operational proof-of-concept token forgery utility rather than a scanner or detection script.
Repository contains a single Python proof-of-concept exploit script and a README. The main file, CVE-2026-55040.py, targets Microsoft SharePoint authentication bypass CVE-2026-55040 by forging JWT tokens with attacker-controlled identity claims. The script supports multiple identity modes: a default LOCAL SERVICE AccessToken identity, a SID-based Active Directory identity, or a UPN-based Active Directory identity. Its workflow is: auto-discover SharePoint token-signing metadata (x5t and realm), optionally discover domain SID and enumerate RIDs via SMB/LSARPC against a domain controller to locate a valid site admin, forge a JWT, then call SharePoint to obtain a form digest for authenticated follow-on requests. The code uses curl as an external HTTP client, supports direct host-to-IP resolution overrides, inspects HTTPS certificates to derive names, and is clearly intended as an exploitation aid rather than mere detection. The README documents usage patterns and shows that successful exploitation yields authenticated access and digest retrieval, while also noting that the script stops short of implementing the final RCE chain ('Step 4: ...RCE...').
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
260 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft SharePoint JWT token-validation authentication-bypass vulnerability. It can be used by unauthenticated attackers to act as a SharePoint site user or administrator and is being weaponized and chained with CVE-2026-63520 for remote code execution.
A critical SharePoint Server JWT authentication-bypass vulnerability. Insufficient or disabled JWT signature validation permits an unauthenticated attacker who knows a target user's SID or UPN to forge a token and impersonate that user, including an administrator. It can be chained with CVE-2026-63520 for unauthenticated server-side code execution.
An authentication bypass vulnerability in Microsoft SharePoint’s JWT validation pipeline that allows attackers to forge tokens and impersonate privileged users.
An authentication bypass vulnerability in Microsoft SharePoint that can be chained with CVE-2026-63520 to achieve unauthenticated remote code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.