PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login

blog.viettelcybersecurity.com | vulnerability | CVE-2026-55040 | #authentication-bypass | #microsoft | #sharepoint | #jwt | #spoofing | #cve-2026-55040
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
CVE
CVE-2026-55040
Published
Collected

Related coverage

tool · github.com
CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass
The public PoC can generate a forged authentication token for a specified account, substantially lowering the barrier to validation and reproduction. Apply Microsoft security updates immediately and test only in isolated, authorized environments.
vulnerability · blog.viettelcybersecurity.com
[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation
Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-22005 Microsoft Sharepoint RCE
Patch analysis of CVE-2022-22005, an RCE in Microsoft SharePoint (CVSS 8.8): diffing SharePoint 2016 builds pinpoints unsafe deserialization in ChartPreviewImage.loadChartImage().
vulnerability · blog.viettelcybersecurity.com
Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE
A patch-diff analysis of CVE-2022-22005 (CVSS 8.8), a SharePoint RCE, tracing Microsoft's fix to a serialization binder restricting types during ChartPreviewImage.loadChartImage() deserialization.
vulnerability · blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
Back