7 Things to Know About CVE-2026-55040: The SharePoint Authentication Bypass Under Active Attack
جدول المحتويات
A critical Microsoft SharePoint vulnerability is being actively exploited in the wild, less than 24 hours after a public proof-of-concept landed online. Here is what your team needs to know right now.
1. What it is: a zero-credential path straight to SharePoint admin
CVE-2026-55040 is a critical authentication bypass in the JWT (JSON Web Token) validation pipeline of on-premises Microsoft SharePoint Server. It carries a CVSS score of 9.1. A remote, unauthenticated attacker can exploit weaknesses in how SharePoint validates Bearer service-to-service tokens to forge a valid JWT and impersonate any user on the farm, including site administrators. No password. No prior access. No user interaction required.
The only prerequisite is knowing the target account’s Active Directory SID or user principal name (UPN), both of which are often discoverable through enumeration.
2. Who found it and how
Rapid7 Senior Principal Security Researcher Stephen Fewer discovered the vulnerability as part of a zero-day research project targeting SharePoint’s attack surface. The exploit chain was built as an entry for Pwn2Own Berlin 2026, and notably, the research methodology involved AI-assisted vulnerability discovery. Microsoft and Rapid7 coordinated disclosure: CVE-2026-55040 was patched on July 14, 2026 as part of Microsoft’s Patch Tuesday updates, with both parties agreeing to a 30-day embargo on full technical details.
3. It is one half of a complete unauthenticated RCE chain
CVE-2026-55040 does not operate alone. Rapid7 chained it with a second SharePoint vulnerability, CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation flaw in Business Connectivity Services. Together, the two vulnerabilities enable fully unauthenticated remote code execution against a vulnerable SharePoint server, code running with the privileges of the SharePoint service account.
Microsoft patched CVE-2026-63520 on August 11, 2026 as part of its August Patch Tuesday cycle. Patching July’s authentication bypass (CVE-2026-55040) is sufficient to break the chain, since it is the first and necessary link. Both patches are required for complete protection.
4. Exploitation started within hours of public PoC release
Rapid7 published its technical analysis and proof-of-concept script for CVE-2026-55040 on August 11, 2026. Threat intelligence firm Defused reported the next day that its SharePoint honeypots were already recording active exploitation attempts using that exact PoC. The window between public disclosure and real-world weaponization was less than one business day.
This is now the fifth SharePoint vulnerability to be exploited in 2026, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
5. Over 8,500 SharePoint servers are exposed right now
Shadowserver’s internet scanning data shows more than 8,500 on-premises SharePoint servers directly accessible from the internet at the time of writing. These are the organizations most immediately at risk. SharePoint Online (Microsoft’s cloud-hosted version) is not affected by either CVE. The vulnerability is limited to on-premises deployments: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
6. SharePoint 2016 and 2019 users face a harder problem
July 14, 2026, the date Microsoft shipped the CVE-2026-55040 patches, was also the end-of-extended-support date for SharePoint Server 2016 and SharePoint Server 2019. The patches released that day were the last security updates those versions will ever receive from Microsoft. Any new vulnerability discovered in those codebases going forward will not be patched. Organizations that cannot immediately migrate to SharePoint Subscription Edition or SharePoint Online should treat this as a forcing function.
7. What your team should do right now
Apply the July 2026 Patch Tuesday update for CVE-2026-55040 immediately if you have not already. Follow it with the August 2026 update for CVE-2026-63520 to close the full RCE chain.
If patching must wait for testing cycles, CISA recommends avoiding direct internet exposure for SharePoint servers wherever possible, and if exposure is unavoidable, placing them behind a Layer 7 reverse proxy or equivalent application-layer control that can inspect and filter requests. Monitor for anomalous authentication activity, particularly forged JWT tokens or unexpected administrative operations. Rapid7 has confirmed it will publish full technical details for CVE-2026-63520 within 30 days of August 11, giving attackers a clear deadline to develop their own tooling against the RCE component.
أسئلة متكررة
No. CVE-2026-55040 and CVE-2026-63520 only affect on-premises deployments: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
Yes, for full protection. The July patch for CVE-2026-55040 breaks the exploit chain on its own, but the August patch for CVE-2026-63520 closes the RCE component. Apply both.
With CVE-2026-55040 alone, an attacker can read files and modify data across the SharePoint farm while impersonating any user. Chained with CVE-2026-63520, they can execute arbitrary code on the server with no credentials at all.
Rapid7 has set a 30-day disclosure window from August 11, meaning full details are expected around September 10, 2026.
Apply the July patches immediately. These are the last patches those versions will ever receive. Start planning migration to SharePoint Subscription Edition or SharePoint Online as a matter of priority.
عن المؤلف
