CVE-2026-55040: Critical SharePoint Authentication Bypass Under Active Attack

How CVE-2026-55040 Works: A JWT Validation Failure

The root cause is a weak authentication flaw (CWE-1390) in SharePoint's JWT validation pipeline. According to Rapid7, who discovered the bug, the vulnerability stems from several distinct weaknesses in how SharePoint's SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes parse Bearer service-to-service tokens . An attacker can send a crafted JWT that the server trusts without proper cryptographic verification, effectively letting them assume the identity of any SharePoint site user or farm administrator .

Microsoft described the flaw simply: "The authentication feature could be bypassed as this vulnerability allows impersonation" . Exploitation allows an attacker to disclose files and modify data, though Microsoft states it cannot impact system availability .

Disclosure and Weaponization Timeline

• July 14, 2026: Microsoft and Rapid7 disclose CVE-2026-55040 and ship patches .
• August 10, 2026: Rapid7 publishes a detailed technical analysis of the vulnerability .
• August 12, 2026: Rapid7 releases a public PoC exploit as a Python script .
• Within days of August 12: Attackers begin actively weaponizing the exploit in the wild .

Rapid7 researcher Stephen Fewer discovered the flaw, noting it is the first in a two-vulnerability chain that, when combined with a second (still-embargoed) flaw, can achieve unauthenticated remote code execution against vulnerable SharePoint servers .

CISA Mitigation Guidance

CISA issued urgent hardening guidance on July 14–15, 2026, and updated it as exploitation escalated . Organizations running on-premises SharePoint should take the following actions immediately:

• Apply the July 2026 cumulative updates to all SharePoint servers in the farm. Verify successful installation through the SharePoint Products Configuration Wizard or PowerShell — a Windows Update alone does not guarantee full servicing . Specific updates include KB 5002891/KB 5002892 for SharePoint 2016 and KB 5002883 for SharePoint 2019 .
• Do not expose SharePoint servers directly to the internet. If internet access is required, place the server behind a Layer 7 reverse proxy or equivalent application-layer security appliance that enforces authentication and inspects requests .
• Block external access to SharePoint Central Administration — this administrative interface should never be reachable from the internet .
• Enable and verify Antimalware Scan Interface (AMSI) integration for every SharePoint web application .
• Rotate IIS machine keys if there is any sign of compromise, and audit for intrusion artifacts before rotating stolen credentials .
• Establish tailored logging and monitoring to detect anomalous authentication patterns, and review authentication and permission logs for the period preceding patch deployment .

Broader Exploitation Context: Three Other CVEs Under Active Attack

CVE-2026-55040 is not an isolated incident. On the same day patches shipped, CISA confirmed active exploitation of three additional SharePoint CVEs :

• CVE-2026-32201 (CVSS 6.5) — A spoofing vulnerability from improper input validation, exploited since at least April 2026 .
• CVE-2026-45659 (CVSS 8.8) — Remote code execution via deserialization of untrusted data. As of August 11, 2026, CISA confirmed that ransomware gangs have begun abusing this flaw .
• CVE-2026-56164 (CVSS 5.3, but exploitable remotely without authentication) — A privilege escalation flaw being actively chained in attacks to steal IIS machine keys and achieve persistent access .

Attackers are chaining these vulnerabilities together: using CVE-2026-32201 for initial access, CVE-2026-45659 or CVE-2026-56164 for code execution, and CVE-2026-55040 as a force multiplier for authentication bypass . The coordinated exploitation campaign has been dubbed the "SharePoint chain" by some researchers .