Attackers have begun using publicly available exploit code for CVE-2026-55040, a critical Microsoft SharePoint authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate SharePoint users, including site administrators.
The exploitation activity was reported on August 12, 2026, one day after a detailed technical analysis and proof-of-concept exploit surfaced for the vulnerability.
CVE-2026-55040 carries a CVSS v3.1 score of 9.1 (Critical) and affects supported on-premises Microsoft SharePoint Server deployments. Microsoft patched the flaw in July 2026, but the rapid weaponization of the public PoC significantly increases the risk for organizations that have not yet applied the relevant SharePoint updates.
Vulnerability Overview
CVE-2026-55040 is a security feature bypass vulnerability caused by weaknesses in SharePoint’s JSON Web Token (JWT) authentication validation process.
A remote attacker does not require valid SharePoint credentials or user interaction to exploit the vulnerability. Instead, an attacker can construct a token that SharePoint incorrectly accepts as legitimate and use it to impersonate a chosen SharePoint user.
Microsoft released patches on July 14 as part of its July 2026 security updates.
Affected Products
Microsoft has released CVE-2026-55040 security updates for:
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
The fixed builds are as follows:
| Product | Security Update | Fixed Build |
| SharePoint Server Subscription Edition | KB5002882 | 16.0.19725.20434 |
| SharePoint Server 2019 | KB5002883 | 16.0.10417.20175 |
| SharePoint Enterprise Server 2016 | KB5002891 | 16.0.5561.1001 |
Organizations should verify the update state across every server in the SharePoint farm, not only externally facing front-end systems.
How CVE-2026-55040 Works
SharePoint supports service-to-service authentication using JSON Web Tokens.
SharePoint’s JWT validation implementation contains four weaknesses that can be combined to allow an attacker to forge an authentication token.
The vulnerable functionality exists within the Microsoft.SharePoint.IdentityModel component responsible for validating service-to-service bearer tokens. SharePoint processes a nested JWT structure containing an outer token representing user identity and an inner actor token intended to represent a trusted calling application.
Four weaknesses exist in this process:
- Signed tokens are not always required.
- The actor token certificate identifier can be resolved without first verifying the token’s signature.
- Issuer validation can accept certificates that have not been properly registered as trusted issuers.
- A token-signature validation path performs a non-cryptographic check rather than fully validating the signature.
When combined, these validation failures allow an attacker to construct a JWT that SharePoint accepts as authenticated even though the attacker does not possess a legitimate trusted signing key.
Attackers Can Impersonate SharePoint Administrators
To impersonate a specific SharePoint user, an attacker needs identifying information for the account.
This can be accomplished using information such as a user’s:
- Active Directory Security Identifier (SID), or
- User Principal Name (UPN).
A UPN commonly resembles an email address, making it potentially easier to obtain than a password or authentication token.
Public PoC Was Rapidly Weaponized
Rapid7 released detailed technical analysis and a public proof-of-concept exploit on August 11, 2026, following a coordinated disclosure period with Microsoft.
By August 12, attackers started using the Rapid7 PoC.
More Than 8,500 SharePoint Servers Are Internet-Exposed
More than 8,500 Microsoft SharePoint servers exposed to the public Internet, according to reporting published on August 12.
Not every system identified by these scans is necessarily vulnerable. Some may already have installed Microsoft’s July updates, and the population may also include honeypots or other non-production systems.
However, the figure illustrates the size of the externally accessible SharePoint attack surface.
Internet-facing SharePoint deployments are particularly attractive targets because attackers can attempt exploitation directly without first gaining access to an internal network.
CVE-2026-55040 Can Be Chained to Remote Code Execution
CVE-2026-55040 is particularly dangerous because authentication bypass can expose functionality that would normally only be reachable after successful login.
Rapid7 originally discovered CVE-2026-55040 as the first component of a two-vulnerability exploit chain capable of achieving unauthenticated remote code execution against SharePoint.
The second vulnerability in the chain is CVE-2026-63520, which Microsoft patched as part of the August 2026 security updates.
CVE-2026-63520 is an RCE vulnerability involving unsafe .NET type instantiation within SharePoint Business Connectivity Services. By itself, the vulnerability requires access to functionality within SharePoint’s authenticated attack surface.
When combined with CVE-2026-55040, however, the authentication requirement can be removed.
The resulting attack chain is therefore:
Unauthenticated attacker → CVE-2026-55040 authentication bypass → authenticated SharePoint identity → CVE-2026-63520 → remote code execution
Rapid7 demonstrated that CVE-2026-63520 can execute arbitrary code using the privileges of the SharePoint site’s service account.
Microsoft deliberately addressed the exploit chain across two security update cycles: the authentication bypass was patched in July, while the RCE component was patched in August.
Organizations should therefore ensure that both the July and August SharePoint security updates have been installed, rather than considering CVE-2026-55040 remediation in isolation.
Potential Impact
Successful exploitation of CVE-2026-55040 can allow attackers to perform SharePoint operations under the identity of another user.
Depending on the permissions associated with the impersonated account, this could enable:
- unauthorized access to confidential SharePoint documents;
- modification or deletion of SharePoint content;
- access to information normally restricted to privileged users;
- impersonation of SharePoint administrators;
- access to authenticated SharePoint attack surfaces;
- chaining with additional vulnerabilities;
- and, when combined with vulnerabilities such as CVE-2026-63520, remote code execution on the SharePoint server.
Microsoft’s CVSS assessment reflects high impact to both confidentiality and integrity, while availability is not directly affected by CVE-2026-55040 itself.
The risk is particularly high for SharePoint environments holding sensitive business information, internal documentation, intellectual property, credentials, configuration data, or other information useful for lateral movement.
Recommended Mitigation and Response
Organizations running on-premises SharePoint should treat CVE-2026-55040 as an urgent patching priority.
- Apply Microsoft’s CVE-2026-55040 security updates immediately.
Ensure all SharePoint Server 2016, 2019 and Subscription Edition servers meet or exceed the fixed builds identified by Microsoft and Rapid7. - Install the August 2026 SharePoint security updates as well.
CVE-2026-63520, the RCE component of Rapid7’s demonstrated exploit chain, was patched during the August update cycle. - Inventory Internet-facing SharePoint infrastructure.
Identify SharePoint servers exposed directly or indirectly through public IP addresses, reverse proxies, load balancers, or externally accessible publishing services. - Reduce unnecessary Internet exposure.
CISA recommends avoiding direct Internet exposure of SharePoint Server where possible and restricting access to SharePoint Central Administration. Internet-facing deployments should be protected using appropriate application-layer controls such as Layer 7 reverse proxies.
Stay Safe. Stay Secure.
OP Innovate Research Team
