SharePoint JWT Authentication Bypass — CVE-2026-55040
Executive Summary
CVE-2026-55040 (CVSS 9.1) is a critical authentication bypass in the JWT token-validation pipeline of on-premises Microsoft SharePoint (SPJsonWebSecurityTokenHandlerV2 / SPJsonWebSecurityBaseTokenHandlerV2), affecting SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Four independently minor validation gaps chain into a complete bypass: (1) the outer token accepts alg: none because RequireSignedTokens is explicitly disabled, (2) the actor token's x5t header can point at SharePoint's own STS certificate thumbprint — retrievable from an unauthenticated metadata endpoint — letting the server resolve a "signing key" with no real verification, (3) issuer validation accepts the token anyway because that certificate is absent from TrustedSecurityTokenServices, and (4) the signature field is only checked for being non-empty, never cryptographically verified. An attacker who knows a target's AD SID or UPN can forge a bearer token and operate as that user — including a site administrator — with zero credentials, zero prior access, and zero user interaction.
Microsoft patched CVE-2026-55040 in the July 14, 2026 Patch Tuesday cycle. Rapid7 researcher Stephen Fewer, who discovered the flaw (demonstrated at Pwn2Own Berlin), published a technical write-up and a Python proof-of-concept on August 11, 2026. Active exploitation followed within about 24 hours: KEVIntel recorded 12 exploitation attempts since July 19, 2026, with 8 of those concentrated on August 12–13 immediately after the PoC dropped, sourced from 8 IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the United States. CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog on August 18, 2026. Rapid7 separately disclosed CVE-2026-63520 (CVSS 8.1), an unsafe .NET type-instantiation RCE in Business Connectivity Services, patched in the August 2026 cycle — chaining the two turns "impersonate a user" into unauthenticated remote code execution with zero barriers at either end.
The defensive reality is uncomfortable: the JWT forgery itself is an HTTP request with a malformed Authorization header — it does not touch process execution, the file system, or the network stack in any way Falcon EDR natively observes. Falcon telemetry only picks the attack up after the attacker acts on the impersonated session (webshell drop, RCE-chain execution, AD reconnaissance). The highest-value defensive angle for this pack is therefore two-layered: patch immediately to remove the bypass entirely, and treat SharePoint's own IIS/ULS logs — not EDR — as the primary detection surface for the forgery step itself.
Defender priority: patch to the July 2026 (CVE-2026-55040) and August 2026 (CVE-2026-63520) cumulative updates immediately — this pair is a public, weaponized, KEV-listed unauthenticated RCE chain against any internet-reachable SharePoint farm. If patching cannot happen today, pull SharePoint off direct internet exposure and place it behind an L7 reverse proxy per CISA guidance until it can.
Source Review & Web Hunter Notes
11 sources were fetched and saved verbatim to SharePoint-CVE-2026-55040-JWTBypass-Hunt-sources/ during research. 9 are cited below as direct citations; 1 (KEVIntel) is cited via cross-corroborated search snippets after a direct fetch produced unreliable data; 1 (Resecurity) was fetched, found on independent verification to be a labelled fictional breach-simulation scenario, and dropped from citation entirely — see callouts below.
| # | Source | Tier | Key finding | Carry forward |
|---|---|---|---|---|
| 1 | The Hacker News | T2 | Exploitation timeline, CISA mitigation guidance | Yes |
| 2 | Rapid7 — Technical Analysis | T1 | Full 4-weakness root-cause chain, attack flow, affected endpoint (/_layouts/15/metadata/json/1) | Yes |
| 3 | Rapid7 — Fixed Announcement | T1 | Disclosure timeline (May 18 → Jul 14 → Aug 11 → Aug 18), KB numbers | Yes |
| 4 | SecurityWeek | T2 | Timeline corroboration, KEV catalog status | Yes |
| 5 | Help Net Security | T2 | Defused honeypot exploitation confirmation, mitigation list | Yes |
| 6 | BleepingComputer | T2 | Shadowserver internet-exposure count (~8,500 instances), 14th exploited SharePoint CVE since 2021 context | Yes |
| 7 | IONIX Threat Center | T3 | Affected-version/KB cross-check (stale exploitation-status snapshot excluded) | Partial |
| 8 | Security Affairs | T2 | Strongest independent corroboration of KEVIntel's 12/8/5-country figures | Yes |
| 9 | Rapid7 — CVE-2026-63520 RCE disclosure | T1 | Chained-RCE root cause (unsafe .NET type instantiation in BCS), KB numbers, Pwn2Own Berlin origin | Yes |
| 10 | KEVIntel (aggregator, corroborated) | T2 | 12 total exploitation attempts since Jul 19; 8 on Aug 12–13; sources HK/JP/NL/TW/US | Yes — corroborated figure only |
| 11 | Resecurity — DROPPED | — | Labelled fictional breach-simulation scenario, not an observed incident | No — excluded |
Anomaly — unreliable tool fetch (not adversarial content, but treated with the same discipline): a direct fetch of kevintel.com/CVE-2026-55040 returned internally-inconsistent numbers (392 attempts, 28 IPs, 8 countries, a Sept-style daily peak) that contradicted every other independently corroborated source (12 attempts / 8 on Aug 12–13 / 5 countries), consistent with the fetch failing to render a JS dashboard and a summarizer fabricating plausible-looking numbers instead of reporting the failure. That fetch was discarded; the corroborated figure is used throughout this pack. See 10-kevintel-corroboration.txt.
Anomaly — dropped source: a fetch of a Resecurity blog post returned highly specific "observed" post-exploitation artifacts (web shell filenames, a malicious IIS module, Windows Event IDs, machine-key-theft code). An independent search on the article's own title returned a summary describing it as containing "a fictional breach simulation scenario illustrating how these vulnerabilities could be exploited" — i.e. Resecurity itself frames it as hypothetical, not a confirmed incident. One artifact name (spinstall0.aspx) also matches a well-known web shell from the unrelated 2025 SharePoint "ToolShell" attack chain, consistent with a narrative reusing familiar names for realism. None of that source's specific artifacts are shipped anywhere in this pack as IOCs, IOA candidates, or "observed" claims — see 11-resecurity-DROPPED-fictional-scenario.txt for the full disposition note. No source consulted describes confirmed, observed post-exploitation activity (web shells, specific dropped files, ULS log signatures) for this CVE as of 2026-08-19; that gap is real and is reflected honestly in Sections 7 and 9 rather than papered over.
Minor cross-source discrepancies (noted, not silently resolved): BleepingComputer and Security Affairs date the Rapid7 PoC to August 12; Rapid7's own post and the majority of other outlets say August 11 — this pack uses August 11. IONIX's cached page lists slightly different secondary KB numbers (KB5002891+KB5002892 for 2016; KB5002883+KB5002885 for 2019) than Rapid7's fixed-announcement primary KBs (KB5002891; KB5002883) — both KB sets are listed in Section 12/13 since dual KBs (core + language-pack) are common on SharePoint Patch Tuesdays.
Hunt Brief & Attack Chain
Hunt hypotheses
| # | Hypothesis | MITRE | Telemetry | Confidence |
|---|---|---|---|---|
| H1 | Unauthenticated recon against the SharePoint STS certificate metadata endpoint, precursor to computing the forged actor-token x5t | T1190, T1589.002 | IIS/L7 logs (non-CQL) | High |
| H2 | SharePoint app pool (w3wp.exe) spawns a command interpreter or script host post-impersonation | T1190, T1059.001/.003, T1210 | ProcessRollup2 | High |
| H3 | w3wp.exe spawns a .NET/COM compiler — dynamic assembly build matching CVE-2026-63520's unsafe-type-instantiation RCE chain | T1055, T1027, T1210 | ProcessRollup2 | High |
| H4 | Domain user/SID enumeration bursts correlated to the SharePoint host, matching Rapid7's documented PoC behavior of querying DCs and enumerating users by SID | T1087.002, T1069.002 | ProcessRollup2, NetworkConnectIP4 | Medium |
| H5 | New or modified ASP.NET file (.aspx/.ashx/.asmx) written under a SharePoint web-application directory by w3wp.exe | T1505.003 | PE/file-write telemetry (⚠ partial fit) | Medium |
| H6 | Privileged SharePoint operation (site-collection admin action, Central Admin access, solution deployment) attributed to an identity with no corresponding interactive/Kerberos Windows logon in the same window — the core "impersonated but never authenticated" gap | T1078, T1078.002 | ULS + Windows Security logs (non-CQL) | Medium |
| H7 | Forged-token structural signature present in the raw request: outer alg:none, actor-token x5t equal to the farm's own STS thumbprint, non-cryptographic placeholder signature | T1606, T1190 | ULS Security Token Service category (non-CQL) | High (source-confirmed mechanism, detection requires elevated ULS verbosity) |
Attack chain
| Step | Action | Telemetry | Hunt angle |
|---|---|---|---|
| 1 | Attacker fetches SharePoint's STS signing certificate from the unauthenticated /_layouts/15/metadata/json/1 endpoint and computes its thumbprint | IIS W3C log | N1 / Q6 |
| 2 | Attacker builds a nested JWT: outer token alg:none (no signature required), inner actor token with x5t pointed at the harvested thumbprint and a claim naming the target user's SID/UPN, placeholder signature (e.g. AAAA) | Not observable at endpoint — request-body structure only | N2 / N4 (ULS) |
| 3 | Forged bearer token sent to SharePoint API (/_api/web/currentuser and others); all four validation gaps pass it; attacker is now authenticated as the impersonated user, up to site admin | ULS Security Token Service category | N2, N3 |
| 4 | Attacker enumerates domain users/admins by SID to select impersonation targets (per Rapid7's PoC description) | ProcessRollup2, NetworkConnectIP4 (if server-side lookups triggered) | Q3, Q5 |
| 5 | (Optional chain) Attacker exploits CVE-2026-63520's unsafe .NET type instantiation in Business Connectivity Services under the impersonated session for unauthenticated RCE | ProcessRollup2 | Q1, Q2 |
| 6 | Persistence via web shell or scheduled task dropped through the RCE / admin session | PE/file-write telemetry, ScheduledTaskRegistered | Q4 |
Consolidated IOC Table
No confirmed atomic network indicators (C2 domain, malicious IP, payload hash) have been published for CVE-2026-55040 as of 2026-08-19 across any source consulted. This is expected for a fresh exploitation wave and is reflected honestly below — the table leans on structural/behavioral signatures instead of fabricated infrastructure.
| Type | Value | Confidence | Action | Context | Expiry |
|---|---|---|---|---|---|
| JWT structure | Outer token header "alg":"none" | High | hunt | Bypass weakness #1 — signature requirement disabled [2] | N/A — technique signature |
| JWT structure | Actor-token x5t equals the farm's own STS certificate thumbprint | High | hunt | Bypass weakness #2 [2] | N/A |
| JWT structure | Non-empty placeholder signature (e.g. literal AAAA) | High | hunt | Bypass weakness #4 [2] | N/A |
| URI path | /_layouts/15/metadata/json/1 (unauthenticated STS cert metadata) | Medium | enrich | Recon precursor endpoint attacker fetches to compute x5t [2] | +1 month |
| Public tooling | Rapid7 sfewer-r7/CVE-2026-55040 PoC (GitHub, Python) — not fetched or reproduced here | High | enrich | Public PoC that drove the Aug 12–13 exploitation spike [2][4] | +3 months |
| Attack-source geography | Hong Kong, Japan, Netherlands, Taiwan, United States (8 unique source IPs, none individually disclosed) | Medium | pivot | KEVIntel-observed exploitation-attempt geography — illustrative recon-source pattern, NOT durable blockable infrastructure [8][10] | +1 month |
| Internet exposure | ~8,500 internet-facing SharePoint instances tracked by Shadowserver at time of reporting | Medium | enrich | Scale-of-exposure context, not a per-org indicator [6] | +1 month |
| File hash / domain / IP | (none published) | — | — | No source consulted disclosed a confirmed malicious hash, C2 domain, or attacker IP for this CVE | — |
Affected Surface & Telemetry Matrix
| Surface | Telemetry source | Priority | Gap risk |
|---|---|---|---|
| SharePoint app tier (IIS / w3wp.exe) — the JWT forgery itself | IIS W3C / L7 logs — not Falcon EDR | Critical | High — the exploitation step is an HTTP request; it never touches process, file, or network telemetry Falcon observes natively |
| SharePoint app tier — post-impersonation actions | Falcon ProcessRollup2 / NetworkConnectIP4 (sensor installed on SharePoint hosts) | High | Low-Medium — good coverage once the attacker acts on the session |
| SharePoint diagnostic logging (ULS) | SPSecurityTokenServiceApplication / Claims Authentication categories | High | High — requires elevating verbosity above default; most farms run at default (Medium) severity, which does not capture token-validation detail |
| Active Directory — impersonated-identity correlation | DC Security event log (4624/4625/4768/4769) | Medium | Medium — impersonation bypasses Windows/Kerberos auth entirely, so the absence of a corresponding logon is itself the signal, which is harder to alert on than a presence-based rule |
| Network perimeter / reverse proxy | WAF / L7 proxy access logs | High | High for orgs without one — CISA explicitly recommends adding an L7 reverse proxy in front of SharePoint; without it there is no independent HTTP-layer visibility at all |
| Patch/vulnerability management | SharePoint build version (16.0.x) | Critical | Low — build number is a deterministic yes/no patch check |
ATT&CK Mapping
| Tactic | Technique | Behavior | Query / control |
|---|---|---|---|
| Initial Access | T1190 — Exploit Public-Facing Application | Unauthenticated JWT-validation bypass in SharePoint's S2S token pipeline | N1, Q6 (recon precursor only — the exploit itself is EDR-invisible) |
| Credential Access / Defense Evasion | T1606 — Forge Web Credentials | Forged actor token: alg:none + spoofed x5t + placeholder signature | N2 (ULS) |
| Privilege Escalation / Initial Access | T1078 / T1078.002 — Valid Accounts (Domain Accounts) | Impersonation of arbitrary site user or admin via SID/UPN claim | N3 (identity-gap hunt) |
| Execution | T1059.001 / T1059.003 — PowerShell / Windows Command Shell | w3wp.exe spawning cmd.exe/powershell.exe | Q1 |
| Execution / Defense Evasion | T1055, T1027 | w3wp.exe spawning a .NET compiler — CVE-2026-63520 gadget-chain RCE pattern | Q2 |
| Persistence | T1505.003 — Server Software Component: Web Shell | New .aspx/.ashx dropped under LAYOUTS or web root | Q4 (⚠ partial-fit event) |
| Discovery | T1087.002 / T1069.002 — Domain Account / Group Discovery | SID/user enumeration matching Rapid7's documented PoC behavior | Q3, Q5 |
| Lateral Movement / Impact | T1210 — Exploitation of Remote Services | Full unauthenticated RCE via the CVE-2026-55040 → CVE-2026-63520 chain | Q1 + Q2 combined, Containment runbook |
Native Audit-Log Hunts
These are the primary detection surface for the actual JWT forgery — Falcon EDR does not see it. None of these are CQL; they run against IIS, SharePoint ULS, and Windows Security logs.
N1 — IIS W3C log: STS metadata recon
Filter for GET requests to /_layouts/15/metadata/json/1 (or the /16/ path on newer builds) from source IPs outside known federation partners or monitoring tools, especially when followed within seconds by a POST to /_vti_bin/*.asmx or /_api/* carrying an unusually large Authorization: Bearer header. Most default IIS W3C log configurations do not capture the Authorization header value itself, so this hunt is presence/timing-based, not content-based, unless extended logging fields are enabled.
N2 — SharePoint ULS log: Security Token Service category
Elevate the SPSecurityTokenServiceApplication and Claims Authentication ULS categories above the default Medium severity (to Verbose or VerboseEx) and search for entries referencing actor-token processing, RequireSignedTokens, or issuer-validation decisions. At default logging levels most farms do not retain enough detail to see the forged-token structure after the fact — this is a "turn it on before you need it" hunt, not a retroactive one.
N3 — Identity-gap correlation
Cross-reference SharePoint claims-based sessions for a site-collection-admin-level UPN/SID against Windows Security Event ID 4624/4768/4769 on the domain controllers serving the SharePoint farm in the same time window. A privileged SharePoint session with no corresponding interactive or Kerberos logon anywhere in AD is the single strongest native signature of this bypass — it is exactly what "impersonation without authentication" looks like in the logs.
N4 — Central Administration access
Alert on any request to the Central Administration site/port from a source IP or account with no prior legitimate access history. Combine with CISA's guidance to block external network access to Central Admin entirely.
N5 — Farm solution / feature deployment audit
Alert on new solution (.wsp) deployment or Feature activation events in the SharePoint Health Analyzer / farm timer job logs that fall outside a documented change window — a likely persistence path once an attacker holds an impersonated admin session.
CrowdStrike LogScale CQL Hunt Queries
These CQL queries cover post-impersonation behavior only (Steps 4–6 of the attack chain in Section 3). The forgery step itself (Steps 1–3) is not visible to Falcon EDR — see Section 7 for that coverage.
Looks for: the SharePoint IIS worker process spawning a shell or script host — the classic post-compromise signature whether the attacker chained CVE-2026-63520 for RCE or abused a legitimate admin function reached via the impersonated session. FP: scheduled solution/CU deployment and farm-admin PowerShell automation also launch from w3wp.exe.
// HUNT: SharePoint app pool (w3wp.exe) spawning a command interpreter or script host // MITRE: T1190, T1059.003, T1059.001, T1210 // CONF: high FP: medium COST: low | REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: scheduled SharePoint solution deployment, farm-admin PowerShell automation launched under the app pool identity // TUNING: exclude known solution-deployment service accounts and documented maintenance windows; scope to hosts in the SharePoint farm asset group #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^w3wp\.exe$/i | FileName=/^(cmd|powershell|pwsh|mshta|wscript|cscript|certutil)(\.exe)?$/i | table([ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
Looks for: dynamic assembly compilation spawned from the SharePoint worker process — matches CVE-2026-63520's root cause (unsafe .NET type instantiation in Business Connectivity Services producing a gadget-chain RCE). FP: SharePoint legitimately compiles temporary assemblies for .wsp solution deployment and some ASPX page compilation, so this is a real, well-known noisy pattern — tune hard before promoting.
// HUNT: SharePoint app pool (w3wp.exe) spawning a .NET/COM compiler // MITRE: T1055, T1027, T1210 // CONF: high FP: medium COST: low | REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: legitimate solution (.wsp) deployment and feature activation compile temporary assemblies under w3wp; first-run ASPX compilation after a CU install // TUNING: exclude scheduled solution-deployment windows and CU install windows; alert preferentially on off-hours or first-time-seen compiler invocation per host #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^w3wp\.exe$/i | FileName=/^(csc|vbc|ilasm|jsc)\.exe$/i | table([ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine, ParentProcessId], limit=200)
Looks for: SID/user enumeration launched from the SharePoint process context — matches Rapid7's documented PoC behavior of querying domain controllers and enumerating users by SID to select impersonation targets. FP: the User Profile Service and People Picker also perform legitimate AD lookups, sometimes via similar child processes during scheduled sync jobs.
// HUNT: SharePoint app pool spawning AD/domain discovery utilities (SID enumeration precursor) // MITRE: T1087.002, T1069.002, T1018 // CONF: medium FP: medium COST: low | REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: User Profile Service synchronization and People Picker resolution also invoke AD lookups from the app pool identity // TUNING: correlate hits with Q1/Q2 on the same aid within a short window; exclude the User Profile sync service account's scheduled sync times #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^w3wp\.exe$/i | FileName=/^(dsquery|dsget|nltest|net1?|whoami)\.exe$/i | CommandLine=/(group|user|sid|\/domain|\/dc)/i | table([ComputerName, aid, UserName, FileName, CommandLine], limit=200)
Looks for: a web-shell drop under LAYOUTS or the site's web root by the app-pool process. ⚠ Field unverified — validate in tenant: PeFileWritten/NewExecutableWritten are real Falcon events but are PE/EXE-oriented; a text-only .aspx drop may not reliably trigger them, and this may need IIS file-integrity monitoring or NG-SIEM file telemetry as a supplement. FP: CU/patch installation and vetted solution deployment also write files under LAYOUTS.
// HUNT: New/modified ASP.NET file (.aspx/.ashx/.asmx) written into a SharePoint web-application directory by w3wp.exe // MITRE: T1505.003 // CONF: medium FP: medium COST: low | REQUIRES: PE/file-write telemetry (field unverified vs. non-PE .aspx writes -- validate in tenant, see card note) // FALSE POSITIVES: CU/patch installation and vetted solution (.wsp) deployment also write files under LAYOUTS // TUNING: exclude scheduled patch/CU installation windows and known solution-deployment automation accounts #event_simpleName=/PeFileWritten|NewExecutableWritten/ | ContextBaseFileName=/^w3wp\.exe$/i | TargetFileName=/\\(TEMPLATE\\LAYOUTS|wwwroot).+\.(aspx|ashx|asmx)$/i | table([ComputerName, aid, ContextBaseFileName, TargetFileName], limit=200)
Looks for: the network-side view of the same SID-enumeration behavior as Q3 — LDAP/LDAPS connections from the SharePoint worker process. FP: legitimate AD lookups from People Picker, User Profile Sync, and Search crawl accounts are frequent and look identical at the network layer; baselining the farm's known DC IP set per environment is required before this is useful.
// HUNT: SharePoint server making LDAP/LDAPS connections outside its normal set of domain controllers // MITRE: T1087.002, T1018 // CONF: medium FP: medium COST: medium | REQUIRES: NetworkConnectIP4, ProcessRollup2 (join) // FALSE POSITIVES: legitimate AD lookups from People Picker, User Profile Sync, and Search crawl service accounts // TUNING: baseline the SharePoint farm's known DC IP set per environment first; alert only on LDAP/LDAPS destinations outside that baseline #event_simpleName=NetworkConnectIP4 | RemotePort=/^(389|636|3268|3269)$/ | rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal) | join(query={#event_simpleName=ProcessRollup2}, field=TargetProcessId_decimal) | ImageFileName=/w3wp\.exe$/i | table([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], limit=200)
Looks for: a client hammering the unauthenticated STS certificate metadata endpoint — the attacker's precursor step before computing the forged actor-token x5t. ⚠ Field unverified — validate in tenant: requires IIS W3C log ingestion into Falcon NG-SIEM; the event name and field names below are generic W3C-convention placeholders and must be remapped to your tenant's actual IIS log repo/parser before use.
// HUNT: Repeated unauthenticated requests to SharePoint's STS certificate metadata endpoint (x5t recon precursor) // MITRE: T1190, T1589.002, T1606 // CONF: medium FP: low COST: medium | REQUIRES: IIS W3C log ingestion into Falcon NG-SIEM (field/event names unverified -- remap to your tenant's actual IIS log repo, see card note) #event_simpleName=/HttpRequestSummary|IisLogEntry/ | cs_uri_stem=/\/_layouts\/1[56]\/metadata\/json\/1/i | groupBy([c_ip], function=[count(as=RequestCount)], limit=500) | RequestCount > 5 | sort(RequestCount, order=desc)
CrowdStrike Custom IOA Recommendations
| Candidate | Pattern | Exclusions | Deployment path |
|---|---|---|---|
| IOA — SharePoint app pool spawns shell/interpreter | Parent w3wp.exe → child in {cmd, powershell, pwsh, mshta, wscript, cscript, certutil} | Documented solution-deployment service accounts and maintenance windows (Q1) | Promote from Q1 after a 2-week benign-baseline period per farm |
| IOA — SharePoint app pool spawns .NET compiler | Parent w3wp.exe → child in {csc, vbc, ilasm, jsc} | Scheduled CU/solution-deployment windows (Q2) | Promote from Q2 only after baselining routine ASPX/solution compilation per farm — this pattern is genuinely noisy on a healthy SharePoint install |
| Investigate-only | Q3, Q4, Q5, Q6 | — | Remain hunt/investigate-only: Q3/Q5 need per-environment DC baselines, Q4 has an unverified event mapping, Q6 needs NG-SIEM field validation before it is IOA-safe |
Machine-Readable IOC Appendix
type,value,action,severity,expiration,description,tags sha256,REPLACE_WITH_SHA256,hunt,high,2026-11-19,No confirmed malicious payload hash published for CVE-2026-55040 as of 2026-08-19 -- placeholder for a webshell or loader dropped via the CVE-2026-63520 RCE chain,campaign:SharePoint-JWT-Bypass domain,REPLACE_WITH_C2_DOMAIN,hunt,medium,2026-09-19,No confirmed C2 domain published for this CVE as of 2026-08-19 -- placeholder for post-exploitation callback infrastructure if identified in your telemetry,campaign:SharePoint-JWT-Bypass ipv4,REPLACE_WITH_SOURCE_IP,hunt,medium,2026-09-19,KEVIntel-observed exploitation source geography (Hong Kong/Japan/Netherlands/Taiwan/US) has no individually disclosed IPs as of 2026-08-19 -- placeholder if a specific attacking IP is confirmed in your own logs,campaign:SharePoint-JWT-Bypass
CVE-2026-55040 forged-token structural signature (grep raw request/ULS capture for all three together): 1. Outer JWT header: "alg":"none" 2. Actor-token header: "x5t" == farm's own STS certificate thumbprint 3. Signature field: any non-empty placeholder (observed example: "AAAA") Recon precursor endpoint (unauthenticated, pre-exploitation): GET /_layouts/15/metadata/json/1 GET /_layouts/16/metadata/json/1 Post-impersonation process pattern: Parent: w3wp.exe -> Child: cmd.exe | powershell.exe | pwsh.exe | mshta.exe | wscript.exe | cscript.exe Parent: w3wp.exe -> Child: csc.exe | vbc.exe | ilasm.exe | jsc.exe (CVE-2026-63520 RCE-chain pattern)
Public PoC (research tooling, NOT reproduced or fetched in this pack): Repo: github.com/sfewer-r7/CVE-2026-55040 (Rapid7 / Stephen Fewer) Published: 2026-08-11 Behavior per Rapid7: forges JWT, queries domain controllers, enumerates users by SID, locates site administrators to impersonate. Chained RCE: CVE-2026-63520 -- SharePoint Business Connectivity Services unsafe .NET type instantiation, CVSS 8.1, patched August 2026. Neither CVE alone reaches unauthenticated RCE; chained together both barriers disappear.
# Confirm patched build (compare against KB-mapped versions in Section 12) (Get-SPFarm).BuildVersion # List installed SharePoint patches/updates for cross-check against KB5002882/ # KB5002883/KB5002891/KB5002893/KB5002894/KB5002896/KB5002905/KB5002906 Get-SPProduct | Select-Object -ExpandProperty PatchableUnitDisplayName # Check current ULS trace severity for the Security Token Service category # (must be Verbose/VerboseEx for N2 to be actionable -- default Medium is not enough) Get-SPLogLevel -Identity "Security Token Service"
Detection Validation Gates
| Gate | Status | Notes |
|---|---|---|
| Telemetry ready | Partial | ProcessRollup2/NetworkConnectIP4 ready wherever Falcon sensor is installed on SharePoint hosts (Q1-Q3, Q5). ULS verbosity (N2) and IIS log ingestion into NG-SIEM (Q6) are almost certainly NOT ready by default and must be explicitly enabled/configured first. |
| Benign baseline established | Not yet — required before IOA promotion | Q2 (w3wp → csc/vbc) is a known-noisy pattern on any actively-used SharePoint farm (routine ASPX/solution compilation). Do not promote to Custom IOA without a 2-week baseline per farm. |
| Positive tests run | Recommended, not performed here | Validate detection logic using Rapid7's authenticated exposure check (InsightVM/Nexpose/Exposure Command, available since 2026-07-15) or a controlled, non-destructive lab reproduction. Do not run the public PoC against production. |
| Promotion path | Documented | Q1/Q2 → Custom IOA after baseline (Section 9). Q3-Q6 remain hunt/investigate-only pending per-environment tuning or field validation. |
Hardening — Tiered
Patch to the July 2026 AND August 2026 cumulative updates. CVE-2026-55040 alone is a KEV-listed, actively-exploited auth bypass; unpatched, it also leaves the door open for the CVE-2026-63520 RCE chain. MITRE M1051 (Update Software).
- Subscription Edition: KB5002882 (build ≥16.0.19725.20434) + KB5002893 for CVE-2026-63520 (build ≥16.0.19725.20522)
- SharePoint Server 2019: KB5002883 (+ KB5002885 per IONIX) for CVE-2026-55040 (build ≥16.0.10417.20175); KB5002894/KB5002896 for CVE-2026-63520 (build ≥16.0.10417.20198)
- SharePoint Enterprise Server 2016: KB5002891 (+ KB5002892 per IONIX) for CVE-2026-55040 (build ≥16.0.5561.1001); KB5002905/KB5002906 for CVE-2026-63520 (build ≥16.0.5565.1001)
Verify: (Get-SPFarm).BuildVersion against the KB-mapped build numbers above.
Reduce internet exposure. Block external access to Central Administration; if SharePoint must remain internet-reachable, place it behind a Layer 7 reverse proxy or equivalent application-layer security control (per CISA guidance). MITRE M1037 (Filter Network Traffic).
Elevate ULS diagnostic logging for the Security Token Service and Claims Authentication categories to Verbose/VerboseEx so Native Hunt N2 is actionable going forward. ⚠ best-practice, no formal CIS/MS-Baseline entry for this specific category change — cited on operational necessity (Section 7) rather than a benchmark.
Enable AMSI Full Mode integration for SharePoint (Microsoft-recommended hardening following the broader pattern of exploited SharePoint auth/RCE chains). MITRE M1040 (Behavior Prevention on Endpoint).
Rotate ASP.NET machine keys and farm service-account credentials after applying the patch, as a precaution against any credential material that may have been exposed during the window the farm was vulnerable. MITRE M1041 (Encrypt Sensitive Information) / general credential-hygiene best practice.
Segment the SharePoint farm tier so app-pool identities can only reach the specific DCs/service accounts they legitimately need for LDAP lookups — narrows both the blast radius of an impersonated session and the noise floor for Q3/Q5. MITRE M1030 (Network Segmentation).
Evaluate migration path off on-premises SharePoint (or onto Subscription Edition with a continuous CU cadence) where Microsoft manages the patch lifecycle for this class of vulnerability. MITRE M1051 (Update Software).
Deployable Playbooks
Playbook 1 — Apply July + August 2026 cumulative updates
1. Prerequisites: full farm backup (content + config DBs), confirmed maintenance window, Farm Admin credentials, SharePoint Products Configuration Wizard access. 2. Download the KB package matching your edition/version from Section 12. 3. Run the binary installer on each server in the farm (Central Admin or SP CU servers first, per Microsoft's documented patch order). 4. Run the SharePoint Products Configuration Wizard (psconfig) on every server: psconfig.exe -cmd upgrade -inplace b2b -wait -force 5. Verify: (Get-SPFarm).BuildVersion matches the target KB build number. 6. Reboot required: Usually NO full OS reboot, but IIS/SharePoint services restart during psconfig -- schedule as if it were a reboot-class change. 7. Rollback: SharePoint CUs are not reliably reversible via uninstall. The supported rollback path is restoring the farm from the pre-patch backup taken in step 1. Do not attempt this patch without a verified backup.
Playbook 2 — Block direct internet exposure of Central Administration
1. Prerequisites: current firewall/NSG rule inventory for the SharePoint farm,
a documented change window, network team sign-off.
2. Identify the Central Administration port (default 2013, but often
customized) via: (Get-SPWebApplication -IncludeCentralAdministration |
Where {$_.IsAdministrationWebApplication}).Url
3. Add/confirm a firewall or reverse-proxy rule denying external (non-internal)
source ranges to that port.
4. If SharePoint content must remain internet-reachable, deploy or confirm an
L7 reverse proxy / WAF in front of the content web application URLs.
5. Reboot required: No.
6. Rollback: Revert the specific firewall/NSG rule change; no service impact
expected from the revert itself.
Playbook 3 — Enable AMSI Full Mode integration for SharePoint
1. Prerequisites: Windows Defender or another AMSI-registered AV/EDR product present and functional on all SharePoint servers; SharePoint 2019/SE (AMSI integration is not available on 2016). 2. Set-SPWebApplication -Identity <WebAppUrl> -AllowAmsiEnable $true -AmsiEnabled $true 3. Repeat for each web application in the farm. 4. Verify: Get-SPWebApplication | Select-Object Url, AllowAmsiEnable, AmsiEnabled 5. Reboot required: No full reboot; an IIS reset (iisreset) is recommended to ensure the setting takes effect immediately. 6. Rollback: Set-SPWebApplication -Identity <WebAppUrl> -AmsiEnabled $false
Playbook 4 — Elevate ULS diagnostic logging for Security Token Service
1. Prerequisites: confirm available disk space for verbose logs (can grow quickly on a busy farm); identify current level first with Get-SPLogLevel -Identity "Security Token Service". 2. Set-SPLogLevel -Identity "Security Token Service" -TraceSeverity VerboseEx 3. Repeat for "Claims Authentication" if present as a distinct category in your build: Set-SPLogLevel -Identity "Claims Authentication" -TraceSeverity VerboseEx 4. Verify: Get-SPLogLevel -Identity "Security Token Service" shows VerboseEx. 5. Reboot required: No. 6. Rollback: Clear-SPLogLevel -Identity "Security Token Service" (returns to the farm default, typically Medium).
Containment Runbook
| Phase | Actions | Owner | Evidence to capture |
|---|---|---|---|
| Isolate | Block external access to affected SharePoint web applications and Central Admin at the perimeter/WAF; if RCE chain (CVE-2026-63520) is suspected, isolate the affected host(s) from the network via EDR containment | Network / SOC | Firewall/WAF change record, EDR containment timestamp |
| Isolate | Capture volatile memory / process listing of w3wp.exe worker processes on affected hosts before any restart | IR | Memory image, process tree export |
| Eradicate | Apply the July + August 2026 cumulative updates (Playbook 1) | SharePoint Admin | Post-patch build version |
| Eradicate | Rotate ASP.NET machine keys and all farm/service-account credentials; cycle the STS signing certificate to invalidate any tokens issued during the exposure window | Identity / SharePoint Admin | Key rotation timestamp, cert thumbprint change record |
| Eradicate | Remove any unauthorized solutions (.wsp), scheduled tasks, or web-accessible files identified via Q3/Q4/N5 | IR | Removed-artifact inventory |
| Recover | If RCE execution is confirmed, restore from a known-good backup predating first suspicious activity rather than attempting in-place cleanup | IR / SharePoint Admin | Restore point ID, integrity verification |
| Recover | Re-enable external access only after the L7 reverse proxy/WAF (Playbook 2) is confirmed in place and patched build is verified farm-wide | Network / SharePoint Admin | Final build-version check, proxy config confirmation |
Detection Coverage Map
| Technique | Behavior | CQL | IOA | Coverage |
|---|---|---|---|---|
| T1190 (initial exploit) | JWT forgery HTTP request | Q6 (recon precursor only, ⚠ unverified fields) | — | GAP — EDR-invisible, requires IIS/NG-SIEM |
| T1606 (forged token structure) | alg:none + spoofed x5t + placeholder signature | — | — | GAP — ULS-only, requires elevated verbosity (N2) |
| T1078 (impersonation) | Privileged action with no corresponding Windows logon | — | — | Partial — N3 identity-gap hunt, manual correlation |
| T1059 / T1027 (post-compromise execution) | w3wp.exe → shell/interpreter | Q1 | Candidate | Good |
| T1055 / T1027 (RCE-chain compile) | w3wp.exe → .NET compiler | Q2 | Candidate (needs baseline) | Partial — high inherent FP, needs per-farm baseline |
| T1505.003 (web shell) | New .aspx/.ashx under LAYOUTS/web root | Q4 (⚠ event mapping unverified) | — | Partial |
| T1087.002 / T1069.002 (discovery) | SID/user enumeration | Q3, Q5 | — | Partial — medium confidence, needs DC baseline |
| T1210 (chained RCE) | Unauthenticated RCE via CVE-2026-55040 → CVE-2026-63520 | Q1 + Q2 combined | Candidate (composite) | Partial |
Validation-gate summary (Section 11): telemetry partially ready (EDR side ready, ULS/NG-SIEM side needs configuration); no benign baseline established yet for the noisy Q2 pattern; no positive/lab tests performed in this build; promotion path documented in Section 9.
Hunt Summary Ticket
TITLE: SharePoint JWT Authentication Bypass -- CVE-2026-55040 (+ chained CVE-2026-63520)
SEVERITY: CRITICAL -- CVSS 9.1, CISA KEV (added 2026-08-18), actively exploited in the wild
SCOPE: All on-prem SharePoint Enterprise Server 2016 / Server 2019 / Server
Subscription Edition instances below the July 2026 (and August 2026
for the RCE chain) cumulative update level, especially internet-facing
farms (~8,500 tracked exposed instances per Shadowserver/BleepingComputer)
HYPOTHESIS: An unauthenticated attacker forged a JWT bearer token (alg:none outer
token, actor-token x5t spoofed to the farm's own STS cert thumbprint,
placeholder signature) to impersonate a SharePoint user or admin, then
acted on that session -- possibly chaining CVE-2026-63520 for RCE.
QUERIES: Q1-Q6 (Section 8); N1-N5 native ULS/IIS/AD hunts (Section 7)
DO FIRST: 1. Confirm patch level: (Get-SPFarm).BuildVersion
2. If unpatched and internet-facing: block external access to Central
Admin immediately; place behind an L7 reverse proxy if content
access must remain
3. Run Q1 and Q2 against the last 7-30 days on all SharePoint hosts
4. Elevate ULS Security Token Service logging (Playbook 4) even if
nothing is found now -- default logging does not retain enough
detail for a retroactive N2 hunt
FINDINGS: [populate at hunt time]
GAPS: - JWT forgery itself is invisible to Falcon EDR; primary detection
surface is IIS/ULS logs, most of which are not enabled by default
at sufficient verbosity
- No confirmed atomic IOCs (hash/domain/IP) published for this CVE
as of 2026-08-19 -- all detections are behavioral
- Q2 (w3wp -> .NET compiler) is a genuinely high-FP pattern on any
active SharePoint farm; do not skip the baseline step
ACTIONS: Patch (Playbook 1) -> reduce exposure (Playbook 2) -> enable AMSI
(Playbook 3) -> elevate ULS logging (Playbook 4) -> run hunt queries
-> if any positive hit, execute Containment Runbook (Section 14)
OWNER: [assign at hunt time]
VERSION: v0.1 -- 2026-08-19
Changelog
References
Not cited: a Resecurity blog post fetched during research, found on independent verification to be a fictional/hypothetical breach-simulation article rather than an observed-incident report. See Section 2 and 11-resecurity-DROPPED-fictional-scenario.txt in the sources folder for full disposition.