CVE-2026-55040: Critical SharePoint Authentication Bypass Now Exploited in Attacks

CVE-2026-55040 — The Most Dangerous SharePoint Entry Point in 2026

A critical authentication bypass vulnerability in Microsoft SharePoint Server — tracked as CVE-2026-55040 (CVSS 9.1) — is now being actively exploited in attacks after security firm Rapid7 published a full proof-of-concept (PoC) exploit. The flaw allows a remote, unauthenticated attacker to forge a valid JWT session and impersonate any SharePoint user, including a farm administrator, without needing credentials .

Rapid7 researcher Stephen Fewer discovered the vulnerability and disclosed it jointly with Microsoft on July 14, 2026 . After Rapid7 released the PoC on August 10, attackers weaponized it and began targeting live systems within days .

Which SharePoint Versions Are Affected?

All currently supported on-premises SharePoint Server editions are vulnerable:

• SharePoint Server 2016
• SharePoint Server 2019
• SharePoint Server Subscription Edition

SharePoint Online (Microsoft 365) is not affected. The flaw does not impact cloud-hosted environments .

How the Exploit Works

CVE-2026-55040 is classified as CWE-1390: Weak Authentication and resides in SharePoint's JSON Web Token (JWT) validation pipeline . Rapid7 described the root cause as "a chain of four distinct weaknesses" in the token-validation logic . An attacker with network access to a vulnerable server can present a forged JWT that the server accepts as valid, allowing them to impersonate any known site user .

If the attacker identifies an account with administrative rights — by its Active Directory username or email — they gain full administrative access to the SharePoint farm . From that position, the flaw can be chained with a separate, unpatched remote code execution vulnerability to achieve full unauthenticated RCE .

Microsoft's Response

Microsoft patched CVE-2026-55040 in the July 2026 Patch Tuesday updates, released July 14, 2026 . The company's advisory stated: "The authentication feature could be bypassed as this vulnerability allows impersonation. Exploiting this vulnerability could lead to authentication bypass."

Microsoft assessed the flaw as allowing an attacker to "disclose files and modify data, but the attacker cannot impact the availability of the system" .

CISA's Advisory and Updated Guidance

CISA's July 14, 2026 alert (AA26-196A) urged immediate SharePoint hardening. At that time, CISA confirmed active exploitation of three other SharePoint CVEs — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — and listed CVE-2026-55040 as newly disclosed but not yet known to be exploited . After Rapid7's PoC release, active exploitation followed quickly, and CISA's updated Known Exploited Vulnerabilities (KEV) catalog now includes CVE-2026-55040 .

The Canadian Centre for Cyber Security also issued advisory AL26-017, adding CVE-2026-55040 to its critical-impact SharePoint list .

Mitigation: No Workarounds — Patch Now

The only effective mitigation is to apply the July 2026 Patch Tuesday updates immediately. There is no workaround or configuration change that can block this vulnerability without the patch .

Additional hardening recommendations from Microsoft and CISA include:

• Restrict network access to SharePoint servers
• Audit for signs of post-exploitation activity
• Monitor for unauthorized JWT token usage

Broader Context: 2026's Wave of SharePoint Exploitation

CVE-2026-55040 is not an isolated incident. Throughout 2026, attackers have been chaining multiple SharePoint vulnerabilities in coordinated campaigns — using an initial access vector like CVE-2026-55040 to gain a foothold, then pivoting to privilege escalation or RCE to deploy ransomware or move laterally across the enterprise . CISA has warned that ransomware gangs are now abusing these SharePoint vulnerabilities .

The following CVEs have all been added to CISA's KEV catalog in 2026:

CVE	Type	CVSS	KEV Entry Date
CVE-2026-32201	Unauthorized access	High	April 14, 2026
CVE-2026-45659	Deserialization RCE	High	July 1, 2026 (later used in ransomware)
CVE-2026-56164	Privilege escalation (missing auth)	5.3	July 14, 2026
CVE-2026-50522	RCE (authenticated)	9.8	July 22, 2026
CVE-2026-58644	Deserialization RCE	9.8	July 23, 2026
CVE-2026-55040	JWT auth bypass	9.1	August 2026

Sources:

The key takeaway: CVE-2026-55040 is the most dangerous entry point in this chain because it requires zero authentication or user interaction. Combined with the other exploited CVEs, any unpatched on-premises SharePoint server is an attractive target. Patching the July 2026 updates is the single most critical defensive action an organization can take.