Summary
CVE-2026-55040 is a critical JWT token authentication bypass vulnerability (CWE-1390: Weak Authentication) in Microsoft SharePoint Enterprise Server 2016, 2019, and Subscription Edition, carrying a CVSS v3.1 base score of 9.1. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer and demonstrated at Pwn2Own Berlin, the flaw allows a remote, unauthenticated attacker to bypass SharePoint’s authentication controls and impersonate any site user or administrator — including by chaining it with a separate, as-yet-unpatched RCE vulnerability to achieve full unauthenticated remote code execution. Microsoft released patches on July 14, 2026 (Patch Tuesday), and CISA has issued a SharePoint hardening alert in response to this and related disclosures.
Technical details
- Root cause: Multiple weaknesses in SharePoint’s JWT token validation pipeline allow an attacker to forge tokens that the server accepts as legitimate.
- Trigger conditions: An attacker must supply a valid target user identifier — either the user’s Active Directory Security ID (SID) or User Principal Name (UPN, formatted as an email address). No authentication or user interaction is required beyond that.
- Attack vector: Remotely exploitable over the network (AV:N); no privileges required (PR:N); no user interaction required (UI:N); low attack complexity (AC:L).
- Impact: A successful exploit lets the attacker perform any SharePoint operation as the impersonated user or administrator. Rapid7 has further demonstrated that CVE-2026-55040 can be chained with a second, currently unpatched RCE vulnerability to achieve full unauthenticated remote code execution against a vulnerable SharePoint server. Patching CVE-2026-55040 breaks this exploit chain even before the RCE component is fixed. The RCE component is expected to be addressed in Microsoft’s August 2026 Patch Tuesday.
- Embargo status: Rapid7 agreed to a 30-day technical details embargo at Microsoft’s request; full technical details will be released within 30 days of July 14, 2026, or earlier if in-the-wild exploitation or third-party publication occurs. No public proof-of-concept exploit is currently available.
Affected software
- Microsoft SharePoint Enterprise Server 2016 (x64) — all versions prior to 16.0.5561.1001
- Microsoft SharePoint Server 2019 (x64) — all versions prior to 16.0.10417.20175
- Microsoft SharePoint Server Subscription Edition (x64) — all versions prior to 16.0.19725.20434
Severity
CVSS v3.1 Base Score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Apply the July 2026 Cumulative Updates immediately:
- SharePoint Server 2016: install KB 5002891 (language-independent) and KB 5002892 (language-dependent). Microsoft recommends installing the complete July 2026 CU rather than individual fixes.
- SharePoint Server 2019: install KB 5002883 (language-independent) and KB 5002885 (language-dependent). Microsoft recommends installing the complete July 2026 CU.
- SharePoint Server Subscription Edition: install KB 5002882 (equivalent to the July 2026 CU for Subscription Edition).
- Network hardening (as recommended by CISA): Avoid exposing SharePoint directly to the internet. If internet access is required, place the instance behind a Layer 7 reverse proxy with authentication controls. Block external access to Central Administration.
- Enable AMSI integration in Full Mode on SharePoint to enable request-body scanning as an additional defensive layer.
- Monitor for anomalous authentication patterns and suspicious worker-process activity indicative of token forgery attempts.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.