# CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Unpatched Chain Component, PoC Public)

> A weak-authentication flaw in the JWT token validation pipeline of on-premises Microsoft SharePoint (CVE-2026-55040, CVSS 3.1 9.1) lets a remote, unauthenticated attacker who knows a target user's Active Directory SID or UPN forge a valid session token and fully assume that user's identity, including administrative accounts. Discovered by Stephen Fewer of Rapid7 Labs during an AI-assisted zero-day research project originally aimed at Pwn2Own Berlin 2026, the flaw was chained with a second, still-unpatched vulnerability to achieve unauthenticated remote code execution against vulnerable SharePoint servers.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-08-19T15:25:44.993Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1341
- **ID:** TL-2026-1341
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-55040, CVE-2026-63520

## Description

CVE-2026-55040 is a weak-authentication (CWE-1390) vulnerability in the JWT token validation pipeline used by on-premises Microsoft SharePoint (SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition). Rapid7 Labs researcher Stephen Fewer identified 'several issues in the JWT token validation pipeline' that allow an attacker to forge or manipulate a session JWT without possessing any credentials. Exploitation requires only that the attacker know a target user's Active Directory Security Identifier (SID) or User Principal Name (UPN, an email-formatted identifier) -- both of which are frequently enumerable via OSINT, prior breaches, Microsoft Graph/Entra ID enumeration, or SharePoint's own user-picker/search endpoints. With a forged token, the attacker impersonates that user -- including SharePoint site administrators -- and inherits their full access to document libraries, lists, workflows, and any connected Microsoft 365/on-prem integrations.

The vulnerability originated from an AI-assisted offensive security research project: Rapid7 ran 96 AI research sessions across 24 active days in two sprints (January 2026 and March 2026), generating roughly 80,000 tool calls hunting for a SharePoint remote-code-execution chain suitable for Pwn2Own Berlin 2026. The January sprint failed to produce a working chain; the March sprint identified CVE-2026-55040 and successfully chained it with a second, separate RCE vulnerability to achieve full unauthenticated remote code execution on a vulnerable SharePoint server. Fewer entered the chain at Pwn2Own Berlin 2026 (May 2026) but could not get the exploit working within the competition's allotted time, earning no prize or Master of Pwn points -- the bug was nonetheless real and was reported to Microsoft immediately after.

Rapid7 reported the finding to Microsoft on 2026-05-18; Microsoft confirmed on 2026-05-20 and opted to patch the chain across two separate update cycles rather than hold the fix until both components were ready: the JWT authentication-bypass component (CVE-2026-55040) is scheduled for the July 2026 Patch Tuesday cycle, while the paired RCE component remains unpatched and is expected in the August 2026 cycle. A coordinated-disclosure agreement was finalized on 2026-05-29, and CVE-2026-55040 was publicly disclosed on 2026-07-14 as part of Microsoft's July 2026 Patch Tuesday release (622 CVEs total, a record volume, including two actively-exploited zero-days unrelated to this chain: CVE-2026-56164 and others).

A meaningful discrepancy exists in severity scoring: Rapid7's own advisory and NVD both list CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N -- network vector, low complexity, no privileges or user interaction required, high confidentiality and integrity impact, no availability impact), consistent with a full-impersonation authentication bypass. Trend Micro's Zero Day Initiative (ZDI) independently rates the same bug Critical at 9.1, while some secondary summaries have cited Microsoft's own MSRC rating as Medium 5.3 -- a four-point spread that industry commentary (The Hacker News) flagged as illustrative of how unreliable a bare CVSS number can be during a high-volume patch month. Given the network-exploitable, unauthenticated, no-user-interaction nature of the flaw and its role as the first link in a demonstrated unauthenticated-RCE chain, this threat record treats CVE-2026-55040 as Critical severity for defensive prioritization purposes.

Because the authentication-bypass half of the chain is now public (via the Rapid7 blog and this disclosure) while the RCE half remains unpatched until August 2026, a live exploitation window exists: any attacker who reverse-engineers or independently discovers the same RCE component can pair it with the now-public JWT bypass technique for unauthenticated remote code execution against any internet- or intranet-exposed, unpatched on-premises SharePoint server. Microsoft and Rapid7 both frame patching the authentication-bypass component (the July fix) as a high-priority mitigation specifically because it breaks the chain before the RCE gadget is fixed. No public PoC exploit code has been released by Rapid7 (technical details remain embargoed for 30 days from the 2026-07-14 disclosure), but the vulnerability class and mechanism are now public knowledge, which materially lowers the bar for independent reproduction.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1606 Forge Web Credentials
- T1550 Use Alternate Authentication Material
- T1649 Steal or Forge Authentication Certificates
- T1087 Account Discovery
- T1482 Domain Trust Discovery
- T1589 Gather Victim Identity Information
- T1595 Active Scanning
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1133 External Remote Services
- T1556 Modify Authentication Process
- T1069 Permission Groups Discovery
- T1119 Automated Collection
- T1596 Search Open Technical Databases
- T1588.002 Obtain Capability: Tool
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1505.003 Server Software Component: Web Shell
- T1505.004 Server Software Component: IIS Components
- T1078.002 Valid Accounts: Domain Accounts
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1027.004 Obfuscated Files or Information: Compile After Delivery
- T1552.004 Unsecured Credentials: Private Keys
- T1087.002 Account Discovery: Domain Account
- T1068 Exploitation for Privilege Escalation
- T1553.002 Subvert Trust Controls: Code Signing
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [CVE-2026-55040 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-55040)
- [Security Update Guide - CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
- [Zero Day Initiative — Pwn2Own Berlin 2026 - Day Two Results](https://www.thezdi.com/blog/2026/5/15/pwn2own-berlin-2026-day-two-results)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1341