Microsoft SharePoint has a serious flaw, CVE-2026-55040, that lets an attacker on the internet log in
as any SharePoint user, including a site administrator, without any password. The problem is a chain of
mistakes in how SharePoint checks its login tokens, so an attacker can forge a valid token using
information the server hands out to anyone. Microsoft released a fix on 14 July 2026, a working attack
tool is now public, and attackers are already using it, so any unpatched SharePoint server should be
updated immediately.
1. Vulnerability Details
CVE ID : CVE-2026-55040
CVSS SCORE : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
EXPLOIT STATUS : Microsoft disclosed and patched the flaw on 14 July 2026 and rated it Critical. Rapid7 released a technical analysis and public proof-of-concept on 11 August 2026, and by 12 August 2026.
Defused reported attackers using that PoC against SharePoint honeypots. Microsoft’s assessment at disclosure was that the flaw was not yet exploited but that exploitation was more likely. There is no workaround.
Microsoft classifies this as CWE-1390 (Weak Authentication). CVE-2026-55040 is an authentication bypass in Microsoft SharePoint’s JWT (JSON Web Token) validation pipeline that lets a remote, unauthenticated attacker forge a token and impersonate any SharePoint site user or administrator. Four flaws chain together: SharePoint disables outer-token signature checks (RequireSignedTokens is false, so alg : none is accepted); it resolves the inner actor token’s signing key from an attacker-supplied x5t thumbprint without verifying the signature; issuer validation accepts SharePoint’s own STS certificate because it is not in the trusted-services list; and the final check only requires a non-empty signature value. The
attacker first reads the STS signing certificate from the unauthenticated/_layouts/15/metadata/json/1endpoint to obtain the thumbprint.
2. Affected Products
- Microsoft SharePoint Server Subscription Edition. Fixed in KB5002882 (build 16.0.19725.20434).
- Microsoft SharePoint Server 2019. Fixed in KB5002883 (build 16.0.10417.20175).
- Microsoft SharePoint Server 2016 and Enterprise Server 2016 (same update). Fixed in KB5002891 (build16.0.5561.1001).
- All three updates were released on 14 July 2026. There is no workaround; apply the update
3. Exploitation Timeline and Impact
Coordinated disclosure credited Stephen Fewer of Rapid7, khoadha, and Chumy Tsai of CyCraft.
- How it is exploited A remote unauthenticated attacker reads the STS signing certificate from/_layouts/15/metadata/json/1, forges a JWT with alg:none and the actor token’s x5t set to that certificate’s thumbprint, and authenticates as a chosen SID, UPN, or local service, up to site administrator.
- Active exploitation Defused reported attackers using Rapid7’s public proof-of-concept against its SharePoint honeypots on 12 August 2026. Successful exploitation allows disclosure of files and modification of data, but not denial of service.
4. Recommendations
- Identify all Microsoft SharePoint Server instances (Subscription Edition, 2019, and 2016) and apply the 14 July 2026 security update for CVE-2026-55040: KB5002882, KB5002883, or KB5002891; there is no workaround.
- Treat unpatched internet-facing SharePoint as potentially compromised: review logs for unauthenticated requests to /_layouts/15/metadata/json/1 followed by privileged actions, and for bearer tokens using alg:none.
- If exploitation is found, rotate SharePoint STS and service credentials, review site administrator accounts and permissions for unauthorised changes, and hunt for follow-on webshells or persistence.
- Take internet-facing SharePoint off the public internet where possible, or restrict access to the unauthenticated /_layouts/15/metadata/json/1 metadata endpoint and the server-to-server authentication surface at a reverse proxy or WAF while patching.
7. Sources
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- https://github.com/sfewer-r7/CVE-2026-55040
- https://x.com/DefusedCyber/status/2087456962896093522
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.