decrypted · 12 august 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

The SharePoint token flaw a researcher published today, and the servers still facing the internet

A researcher published the full working detail of a SharePoint authentication bypass today, hours after Microsoft finished patching it in two instalments across July and this week's Patch Tuesday. Attackers were already firing the proof of concept at honeypots before the day was out. On-premises SharePoint sits behind the login page of a lot of UK government and enterprise intranets, which makes this one worth checking this evening rather than at the next patch window.

A wristband nobody checked properly

CVE-2026-55040 is a flaw in SharePoint's JWT token validation pipeline, rated 9.1 out of 10. It was found by Rapid7's Stephen Fewer, demonstrated at Pwn2Own Berlin, and reported to Microsoft on 18 May. Microsoft agreed to fix it across two update cycles: July closed the authentication bypass, August closed a second, chained flaw that turns a forged login into full remote code execution on the server.

Think of a JWT as a wristband at a gated event. The door is supposed to check that the wristband was issued by the box office, using a signature only the box office can produce. What the flawed validation pipeline actually checked was closer to the name written on the wristband. An attacker who already knows a target's Active Directory security identifier or user principal name, both easy to gather, could write themselves a wristband marked "site administrator" and the door let them through. Rapid7 published its technical write-up and proof of concept on Tuesday, and within hours the threat intelligence firm Defused reported the exploit running against its SharePoint honeypots.

The design lesson, not just the patch

The interesting failure here isn't that a bug existed, it's what the bug reveals about the assumption underneath it: a token is only as trustworthy as the verification chain behind it, and that chain needs to check cryptographic proof of issuance, not attacker-suppliable identifiers. Any product built on tokens, homegrown or vendor, is worth a genuine question: does the validator prove the token was issued to this identity, or does it merely check that the token looks like one that could have been?

There is a second, quieter lesson for UK organisations specifically. On-premises SharePoint was designed for a trusted internal network, and a lot of installations are now reachable from the internet because hybrid working made that convenient. CISA has been warning since the spring that this family of SharePoint flaws poses a standing risk to any instance facing outward. The fix this week is to apply both the July and August updates, rotate IIS machine keys, review logs for signs of deserialisation abuse, and, separately from patching, ask whether SharePoint Central Administration needs to be reachable from outside the network at all. A patched system that shouldn't have been exposed in the first place is still carrying risk the patch doesn't remove.

Also this week

A CRM breach with a familiar signature. US distributor Wesco confirmed a cybersecurity incident this week after the extortion group ExfilSquad published data it claims to have taken from Wesco's cloud CRM, roughly 2.6 million records of customer and staff information. Wesco says it has found no ransomware on its systems and no evidence that payment or financial data was exposed. ExfilSquad is the same group behind the breach of the UK's Police National Legal Database three weeks ago, where 135,000 officer and staff records were taken from a service used by every Home Office force in England and Wales. Different victim, same playbook: a cloud platform holding far more contact and account data than any single incident needed to expose. UK organisations running CRM in the cloud should treat this as a prompt to check what a compromised vendor account could actually reach.

Nearly 800 npm packages weaponised in three days. Researchers at Sonatype identified a campaign, dubbed Flooding Dropper, that published almost 800 malicious npm packages using AI-generated typosquat names, growing past 1,000 packages by the time it slowed. Rather than the usual install-time hooks, the packages instruct developers to load them with a plain require() call, which most dependency scanners don't treat as suspicious. The payload fingerprints the host and pulls a second-stage tool for Windows, macOS or Linux. Any UK team pulling dependencies from npm this week should check recent installs against Sonatype's indicators rather than assume a clean scan settles it.

NCSC wants resilient private 5G, and is asking industry to say how. The NCSC opened a call for expressions of interest from suppliers who can build portable, certificate-authenticated private 5G networks that keep working when fixed infrastructure is degraded or attacked, with submissions due by 31 August. It's a procurement signal rather than an incident, but it says something about where the NCSC expects the next resilience gap to be: not in the data centre, but in the network path getting to it.

Sources

Working through a SharePoint patch decision or a CRM vendor risk review of your own? Get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.