Threat Summary
On August 11, 2026, Rapid7 released a Proof-of-Concept (PoC) for CVE-2026-55040, a critical authentication bypass affecting Microsoft SharePoint Server Subscription Edition, SharePoint Enterprise Server 2016, and SharePoint Server 2019. The flaw exists in the JWT (JSON Web Token) validation pipeline. This flaw enables a remote unauthenticated attacker to forge valid JWTs and impersonate any SharePoint user, including administrators, by knowing their SID or UPN. Attackers can craft these tokens due to weak token validation logic that fails to properly validate signatures, allowing them to access and perform any actions available to the impersonated account. Exploitation is trivial for attackers with knowledge of SharePoint APIs as it requires no special privileges and only minimal information about the target environment.
Microsoft coordinated the disclosure and provided a patch as part of their July 14, 2026 Patch Tuesday. Affected version are SharePoint Server 2016 (<16.0.5561.1001), 2019 (<16.0.10417.20175), and Subscription Edition (<16.0.19725.20434). At the time of writing, CISA has not added this vulnerability to its Known Exploited Vulnerability (KEV) catalog, but notes it as a potential risk if left unpatched. Defused Cyber has observed active exploitation using weaponized PoC code shortly after disclosure. The exposure risk is critical and the vulnerability is assigned a 9.1 CVSS score, making rapid response mandatory.
Organizations running on-premises SharePoint, especially in regulated, government, or air-gapped environments, are advised that this threat bypasses all authentication controls native to SharePoint and could result in data compromise, privilege escalation, or follow-on attacks such as deployment of backdoors or ransomware. Rapid patch deployment and ongoing monitoring is essential.
Recommendations for CVE-2026-55040
Immediate Actions (High Priority):
- Identify all instances of SharePoint Server 2016 (<16.0.5561.1001), 2019 (<16.0.10417.20175), and Subscription Edition (<16.0.19725.20434) in your environment.
- Deploy Microsoft’s cumulative security patch to all affected systems without delay. Use Microsoft Update, Update Catalog, or Download Center.
- 2016: KB5002891 (+ KB5002892 for language packs)
- 2019: KB5002883 (+ KB5002885 for language packs)
- Subscription Edition: KB5002882
- After patching, follow Microsoft’s PowerShell guidance if defense-in-depth issues arise:
- $farm = Get-SPFarm
- $farm.DisableActorTokenAudienceValidation = $true
- $farm.update()
- (Execute after running PSConfig, if advised by Microsoft post-patch instructions.)
Configuration Hardening:
- Ensure SharePoint servers are NOT exposed directly to the internet. Use Layer 7 reverse proxies with authentication where exposure is unavoidable.
- Block public and broad internal access to SharePoint Central Administration.
- Enable and configure Antimalware Scan Interface (AMSI) with Full Request Body Scanning on all SharePoint web applications. Enable detection signatures such as Exploit:Script/SuspSignoutReqBody.A.
- Enforce strong TLS (1.2+ with robust cipher suites) for all communication.
Long-Term Preventive Measures:
- Develop rapid patching procedures for SharePoint and other critical systems.
- Routinely audit SharePoint farm security configurations and restrict unnecessary authentication schemes.
- Conduct regular compromise assessments and credential rotations, especially after critical patches.
Temporary Workarounds
If immediate patching is NOT feasible, implement the following compensating controls until remediation:
- Restrict external (internet) access: Place SharePoint behind an authenticated reverse proxy/firewall; block access to all except trusted users.
- Block access to SharePoint Central Administration from all but a tightly controlled management subnet.
- Enable AMSI integration and full request body scanning.
- Harden internal firewall rules to restrict SharePoint farm communications.
- Limit user enumeration: monitor for attempts to access /_layouts/15/metadata/json/1 and /_api/web/currentuser endpoints (used in attack chains), though note that prevention of token forgery requires patch, not blocking these paths alone.
- Note: These are not a substitute for patching. The logic flaw remains, and determined attackers may still succeed if patch is not applied.
- Apply Microsoft’s PowerShell workaround only if instructed, as disabling actor token validation may impact functionality or security (see KB5002882 notes).
References:
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- https://nvd.nist.gov/vuln/detail/CVE-2026-55040
- https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/
- https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4208511
