CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Unpatched Chain Component, PoC Public)

CVE-2026-55040 (TL-2026-1341), also tracked as SharePoint JWT Auth Bypass, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-07-14 and last reviewed 2026-08-19. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 2 CVEs (CVE-2026-55040, CVE-2026-63520), maps to 35 MITRE ATT&CK techniques (T1005, T1021.002, T1027), and is covered by 9 detection rules and 39 indicators of compromise.

Key facts for TL-2026-1341

Threat ID
TL-2026-1341
Also known as
SharePoint JWT Auth Bypass, Pwn2Own Berlin 2026 SharePoint Chain
Severity
CRITICAL
CVSS
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-08-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, education, technology, manufacturing, legal
Target regions
North America, Europe, Asia Pacific, Global
Detection rules
9
Indicators of compromise
39
Updates
2026-08-19 · 2 updates · revalidated 2× · latest source

A weak-authentication flaw in the JWT token validation pipeline of on-premises Microsoft SharePoint (CVE-2026-55040, CVSS 3.1 9.1) lets a remote, unauthenticated attacker who knows a target user's Active Directory SID or UPN forge a valid session token and fully assume that user's identity, including administrative accounts. Discovered by Stephen Fewer of Rapid7 Labs during an AI-assisted zero-day research project originally aimed at Pwn2Own Berlin 2026, the flaw was chained with a second, still-unpatched vulnerability to achieve unauthenticated remote code execution against vulnerable SharePoint servers.

How CVE-2026-55040 works

CVE-2026-55040 is a weak-authentication (CWE-1390) vulnerability in the JWT token validation pipeline used by on-premises Microsoft SharePoint (SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition). Rapid7 Labs researcher Stephen Fewer identified 'several issues in the JWT token validation pipeline' that allow an attacker to forge or manipulate a session JWT without possessing any credentials. Exploitation requires only that the attacker know a target user's Active Directory Security Identifier (SID) or User Principal Name (UPN, an email-formatted identifier) -- both of which are frequently enumerable via OSINT, prior breaches, Microsoft Graph/Entra ID enumeration, or SharePoint's own user-picker/search endpoints. With a forged token, the attacker impersonates that user -- including SharePoint site administrators -- and inherits their full access to document libraries, lists, workflows, and any connected Microsoft 365/on-prem integrations.

The vulnerability originated from an AI-assisted offensive security research project: Rapid7 ran 96 AI research sessions across 24 active days in two sprints (January 2026 and March 2026), generating roughly 80,000 tool calls hunting for a SharePoint remote-code-execution chain suitable for Pwn2Own Berlin 2026. The January sprint failed to produce a working chain; the March sprint identified CVE-2026-55040 and successfully chained it with a second, separate RCE vulnerability to achieve full unauthenticated remote code execution on a vulnerable SharePoint server. Fewer entered the chain at Pwn2Own Berlin 2026 (May 2026) but could not get the exploit working within the competition's allotted time, earning no prize or Master of Pwn points -- the bug was nonetheless real and was reported to Microsoft immediately after.

Rapid7 reported the finding to Microsoft on 2026-05-18; Microsoft confirmed on 2026-05-20 and opted to patch the chain across two separate update cycles rather than hold the fix until both components were ready: the JWT authentication-bypass component (CVE-2026-55040) is scheduled for the July 2026 Patch Tuesday cycle, while the paired RCE component remains unpatched and is expected in the August 2026 cycle. A coordinated-disclosure agreement was finalized on 2026-05-29, and CVE-2026-55040 was publicly disclosed on 2026-07-14 as part of Microsoft's July 2026 Patch Tuesday release (622 CVEs total, a record volume, including two actively-exploited zero-days unrelated to this chain: CVE-2026-56164 and others).

A meaningful discrepancy exists in severity scoring: Rapid7's own advisory and NVD both list CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N -- network vector, low complexity, no privileges or user interaction required, high confidentiality and integrity impact, no availability impact), consistent with a full-impersonation authentication bypass. Trend Micro's Zero Day Initiative (ZDI) independently rates the same bug Critical at 9.1, while some secondary summaries have cited Microsoft's own MSRC rating as Medium 5.3 -- a four-point spread that industry commentary (The Hacker News) flagged as illustrative of how unreliable a bare CVSS number can be during a high-volume patch month. Given the network-exploitable, unauthenticated, no-user-interaction nature of the flaw and its role as the first link in a demonstrated unauthenticated-RCE chain, this threat record treats CVE-2026-55040 as Critical severity for defensive prioritization purposes.

Because the authentication-bypass half of the chain is now public (via the Rapid7 blog and this disclosure) while the RCE half remains unpatched until August 2026, a live exploitation window exists: any attacker who reverse-engineers or independently discovers the same RCE component can pair it with the now-public JWT bypass technique for unauthenticated remote code execution against any internet- or intranet-exposed, unpatched on-premises SharePoint server. Microsoft and Rapid7 both frame patching the authentication-bypass component (the July fix) as a high-priority mitigation specifically because it breaks the chain before the RCE gadget is fixed. No public PoC exploit code has been released by Rapid7 (technical details remain embargoed for 30 days from the 2026-07-14 disclosure), but the vulnerability class and mechanism are now public knowledge, which materially lowers the bar for independent reproduction.

MITRE ATT&CK techniques used in TL-2026-1341

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1027.004 Obfuscated Files or Information: Compile After Delivery; T1550.001 Use Alternate Authentication Material: Application Access Token; T1553.002 Subvert Trust Controls: Code Signing

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1078.002 Valid Accounts: Domain Accounts

Discovery

T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component; T1505.003 Server Software Component: Web Shell; T1505.004 Server Software Component: IIS Components

lateral-movement

T1550 Use Alternate Authentication Material

Credential Access

T1552.004 Unsecured Credentials: Private Keys; T1649 Steal or Forge Authentication Certificates

defense-impairment

T1556 Modify Authentication Process

Resource Development

T1588.002 Obtain Capability: Tool

Reconnaissance

T1589 Gather Victim Identity Information; T1595 Active Scanning; T1596 Search Open Technical Databases

credential-access

T1606 Forge Web Credentials

Affected products and versions in CVE-2026-55040

  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: < 16.0.5561.1001
    Fixed in: 16.0.5561.1001
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: < 16.0.10417.20175
    Fixed in: 16.0.10417.20175
  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: < 16.0.19725.20434
    Fixed in: 16.0.19725.20434

Remediation for CVE-2026-55040

Patches

  • Microsoft July 2026 Patch Tuesday cumulative update for SharePoint Enterprise Server 2016 (fixed build 16.0.5561.1001 or later)
  • Microsoft July 2026 Patch Tuesday cumulative update for SharePoint Server 2019 (fixed build 16.0.10417.20175 or later)
  • Microsoft July 2026 Patch Tuesday cumulative update for SharePoint Server Subscription Edition (fixed build 16.0.19725.20434 or later)
  • Second, separate patch for the paired RCE component expected in Microsoft's August 2026 Patch Tuesday cycle -- track and apply as soon as released

Immediate actions

  • Apply Microsoft's July 2026 Patch Tuesday update for on-premises SharePoint to remediate the JWT authentication-bypass component (CVE-2026-55040) as soon as it is available for the deployed SharePoint build
  • Inventory all internet-facing and internal on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition instances and confirm patch level against the fixed builds
  • Restrict SharePoint front-end exposure to trusted networks (VPN/ZTNA) where internet exposure is not a business requirement
  • Rotate and audit SharePoint/ADFS/Entra machine keys and session-signing keys if compromise is suspected
  • Monitor for anomalous SharePoint authentication events where session tokens map to users who show no corresponding interactive logon (classic impersonation signature)
  • Restrict enumeration of Active Directory SIDs and User Principal Names via LDAP/Graph query throttling and disabling anonymous directory queries

Workarounds

  • Where immediate patching is not possible, restrict SharePoint authentication endpoints to trusted source IP ranges via WAF/reverse proxy rules
  • Disable or restrict anonymous/guest access features on affected SharePoint farms
  • Increase logging verbosity on SharePoint STS/claims authentication components and forward to SIEM for anomaly detection pending patch deployment

Longer-term hardening

  • Deploy EDR/XDR with behavioral detection on SharePoint front-end and application servers to catch post-impersonation activity (unusual admin actions, mass document access, workflow abuse)
  • Implement network segmentation isolating SharePoint farm servers from general user VLANs and from domain controllers where not strictly required
  • Adopt SharePoint Online / Microsoft 365 migration roadmap to reduce on-premises SharePoint attack surface where feasible
  • Establish a fast-patch SLA for on-premises SharePoint given its recurring history of critical authentication and RCE vulnerabilities (ToolShell/2025 chain, this 2026 chain)
  • Integrate Rapid7 InsightVM/Nexpose or equivalent vulnerability management authenticated checks for CVE-2026-55040 into continuous scanning

CVEs associated with CVE-2026-55040

CVE-2026-55040, CVE-2026-63520

Weaknesses (CWE) in CVE-2026-55040

CWE-1390, CWE-20

Timeline of CVE-2026-55040

  • Rapid7 Labs begins first AI-assisted research sprint targeting Microsoft SharePoint for a Pwn2Own Berlin 2026 exploit chain; sprint concludes without a working exploit
  • Rapid7's second AI-assisted research sprint identifies the JWT token validation pipeline flaw and successfully chains it with a separate RCE vulnerability to achieve unauthenticated remote code execution in testing
  • Stephen Fewer of Rapid7 enters the SharePoint exploit chain at Pwn2Own Berlin 2026 but cannot get it working within the allotted competition time; no prize awarded
  • Rapid7 formally reports the JWT authentication-bypass and chained RCE findings to Microsoft
  • Microsoft confirms the findings and elects to patch the authentication-bypass and RCE components across two separate update cycles
  • Rapid7 and Microsoft finalize a coordinated-disclosure agreement covering the split-cycle patch plan
  • Rapid7 ships authenticated vulnerability checks for CVE-2026-55040 in InsightVM, Nexpose, and Exposure Command content releases
  • CVE-2026-55040 publicly disclosed as part of Microsoft's July 2026 Patch Tuesday (622 CVEs total); Rapid7 publishes its technical advisory; NVD and MSRC entries go live; full exploit technical detail remains embargoed for 30 days
  • KEV Intelligence sensors begin recording exploitation attempts against CVE-2026-55040 with confirmed confidence, the earliest of 12 total attempts logged.
  • Microsoft's August 2026 Patch Tuesday cycle is expected to deliver the fix for the paired, still-unpatched RCE component that completes the exploit chain
  • Microsoft ships the August 2026 Patch Tuesday fix for CVE-2026-63520, the Business Connectivity Services RCE flaw that chains with CVE-2026-55040 for unauthenticated code execution.
  • Threat intelligence firm Defused confirms attackers are using the Rapid7 PoC against SharePoint honeypots within hours of its publication.
  • Rapid7 researcher Stephen Fewer publishes a technical write-up and public Python PoC (CVE-2026-55040.py) for the JWT authentication bypass on GitHub.
  • Cyber Security News, The Hacker News, and Security Affairs publish coverage of active in-the-wild exploitation following the public PoC release.
  • KEV Intelligence records a spike of 8 exploitation attempts in a single day, originating from 8 unique IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.
  • CISA adds CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation and public PoC availability; sets a 3-day remediation deadline of 2026-08-21.
  • Cyber Security News and other outlets report continued active exploitation as CISA's 3-day KEV remediation deadline nears (2 days remaining).

Update history for TL-2026-1341

Sources cited for CVE-2026-55040

Threats related to CVE-2026-55040

Detection coverage for TL-2026-1341

As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1341 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats