August 2, 2026 · Alastor InfoSec Team
CVE-2026-55040: Microsoft SharePoint JWT Authentication Bypass (CVSS 9.1) Chains With Unpatched RCE — Patch Now
A critical authentication bypass vulnerability in Microsoft SharePoint Server is giving unauthenticated remote attackers the ability to impersonate any site user or administrator — and when chained with a separate, as-yet-unpatched remote code execution flaw, the combination delivers full unauthenticated RCE against vulnerable deployments. The vulnerability, tracked as CVE-2026-55040, carries a CVSSv3.1 score of 9.1 and affects SharePoint Server 2016, 2019, and Subscription Edition.
Microsoft patched CVE-2026-55040 in July 2026 as part of Patch Tuesday — a month that set a record with fixes for 570 separate flaws. Patches for the chained RCE vulnerability are scheduled for the August 2026 update. That means organizations running unpatched SharePoint are currently exposed to an authentication bypass with a known, exploitable path to remote code execution — even if the RCE component is not yet publicly documented.
What CVE-2026-55040 Is and How It Works
CVE-2026-55040 is a weakness in SharePoint Server's JWT (JSON Web Token) token validation pipeline, classified under CWE-1390 (Weak Authentication). JSON Web Tokens are how SharePoint verifies the identity of users making requests to the server. A flaw in how SharePoint validates those tokens allows a remote, unauthenticated attacker to construct a token that passes authentication checks while specifying the identity of any legitimate site user — including administrators.
The prerequisite for exploitation is that the attacker must know in advance which user they wish to impersonate. In practice, this is a low bar. SharePoint site member lists are frequently accessible to authenticated users within an organization, and in many enterprise deployments, admin accounts follow predictable naming conventions. More importantly, an attacker does not necessarily need to impersonate a specific named individual — they need to know that an account with the required privileges exists, which is almost always true for any active SharePoint deployment.
Once authentication is bypassed, the attacker operates with the full permissions of the impersonated account. For a SharePoint site administrator, that means the ability to read, modify, and delete content across the deployment, install server-side solutions and apps, and access configuration settings — all without presenting a valid credential.
Affected Versions
The following SharePoint versions are confirmed vulnerable if not yet patched:
Microsoft SharePoint Enterprise Server 2016 (x64) — all versions prior to 16.0.5561.1001. Microsoft SharePoint Server 2019 (x64) — all versions prior to 16.0.10417.20175. Microsoft SharePoint Server Subscription Edition (x64) — all versions prior to 16.0.19725.20434.
SharePoint Online (Microsoft 365) is not affected — the vulnerability is specific to on-premises deployments.
The Chained Attack: From Auth Bypass to Full RCE
CVE-2026-55040 on its own is a critical flaw. Combined with a second, currently unpatched vulnerability, it becomes something more severe: a path to unauthenticated remote code execution.
The unpatched RCE vulnerability requires a certain level of SharePoint permissions to trigger. CVE-2026-55040 provides exactly that — by allowing the attacker to impersonate a site administrator, they satisfy the permission prerequisite for the RCE vulnerability without needing any legitimate credentials. The result is a two-step exploitation chain: authenticate-bypass-as-admin, then trigger RCE.
Microsoft has confirmed the patch for the chained RCE component is scheduled for August 2026. Until that patch ships, organizations running unpatched SharePoint Server are exposed to the full chain. This is not a theoretical concern — Rapid7 and Tenable have both published technical analyses of the JWT bypass, and once a vulnerability of this severity has detailed public analysis, weaponized exploits typically follow within days to weeks.
What Attackers Do With SharePoint Access
Compromised SharePoint servers are high-value targets beyond simple data theft. SharePoint Server on-premises deployments commonly store sensitive internal documents, HR records, financial data, source code, and compliance evidence. In BFSI and healthcare environments, the stored data frequently includes categories of personal data that carry elevated obligations under India's DPDP Act.
Beyond data exfiltration, SharePoint servers are frequently used as pivot points into enterprise networks. IIS-hosted SharePoint installations share infrastructure with other internal services, and a compromised SharePoint server with admin-level execution capability provides a persistent foothold from which attackers can move laterally, harvest credentials from memory, and establish long-term access through web shells. The July 2026 wave of SharePoint exploitation — which saw nation-state actors and ransomware groups including the Storm-2603 threat actor operating Warlock ransomware — demonstrates exactly this playbook in practice.
CVSS Breakdown
The CVSSv3.1 vector for CVE-2026-55040 scores 9.1 Critical, with network attack vector, no authentication requirement, low attack complexity, and high impact on confidentiality, integrity, and availability of the affected system. The score reflects that while the attacker must know a username to impersonate, the barrier to discovering that information is minimal in most enterprise environments.
Remediation Steps
Apply the July 2026 patches immediately. The specific Knowledge Base articles are KB5002882 for SharePoint Server 2019 and the equivalent updates for SharePoint 2016 and Subscription Edition. These patches address the JWT validation flaw in CVE-2026-55040 and must be applied to all on-premises SharePoint servers in your environment, including farm members that may not be directly internet-facing.
Stage the August 2026 patch for immediate application on release. The second component of the attack chain will be patched in the August 2026 update cycle. Do not wait for your normal monthly patch cadence — schedule this patch for deployment within 24 to 48 hours of release.
Audit SharePoint access logs for anomalous authentication patterns. CVE-2026-55040 exploitation will generate authentication events where the user identity in the JWT token does not match any observed login session. Correlate SharePoint ULS logs and IIS access logs for requests where the authenticated user identity appears without a corresponding login event, particularly for administrative accounts.
Restrict SharePoint to internal network access where possible. Internet-facing SharePoint Server deployments have the widest exposure to CVE-2026-55040. Where business requirements allow, placing SharePoint behind a VPN or network access control boundary significantly reduces the risk of unauthenticated exploitation from external attackers.
Rotate credentials for SharePoint farm service accounts and site administrators. As a precautionary measure, rotate credentials for any high-privilege accounts on affected SharePoint deployments. If the chained RCE has already been exploited in your environment, attackers may have harvested service account credentials from memory.
Review IIS machine keys and web shell indicators. The July 2026 SharePoint exploitation campaign targeting CVE-2026-45659 and related flaws focused heavily on stealing IIS machine keys to forge authentication tokens independently of any specific CVE. Verify that your IIS machine keys have not been accessed or exfiltrated, and check for unexpected .aspx, .ashx, or .asmx files in SharePoint's wwwroot and application directories.
Detection Guidance
From a detection standpoint, CVE-2026-55040 exploitation is visible in SharePoint's ULS logs as authentication events where the JWT claims are malformed or reference accounts in ways that should not be possible given the authentication flow. Security teams running SIEM solutions should build detection rules that flag administrative operations performed against SharePoint where no corresponding interactive login is present in the authentication logs for the same time window.
Endpoint detection on the SharePoint server itself — looking for unusual process spawning from the SharePoint application pool, w3wp.exe executing PowerShell or cmd.exe, or unexpected network connections — is the secondary detection layer for cases where the authentication bypass has already been used to trigger the chained RCE.
Why On-Premises SharePoint Is a Persistent Risk
The July and August 2026 SharePoint vulnerability wave — CVE-2026-45659, CVE-2026-56164, CVE-2026-56155, CVE-2026-50522, CVE-2026-58644, and now CVE-2026-55040 — is not coincidental. On-premises SharePoint is a well-understood, high-value target with a large installed base across enterprise, government, and financial services organisations. Nation-state threat actors and ransomware groups have invested heavily in SharePoint exploitation research because the return on a successful compromise is consistently high.
For organisations running on-premises SharePoint, the risk calculus is straightforward: every unpatched month is an open window for any of these attack chains. Microsoft's July 2026 record of 570 patched flaws also signals that the complexity of the SharePoint codebase makes new vulnerabilities an ongoing certainty, not an occasional event.
If your organisation is running on-premises SharePoint and does not have a continuous patching and monitoring programme in place, the question is not whether you will encounter a critical SharePoint vulnerability — it is whether you will encounter it before or after you have patched.
How Alastor Can Help
Alastor Pulse continuously tests your SharePoint and web application attack surface, flagging authentication control weaknesses and configuration gaps before they become breach paths. Enforster AI scans for abnormal authentication patterns, credential exposure, and web shell indicators across your infrastructure in real time.
To assess your SharePoint security posture or schedule an immediate VAPT engagement covering your on-premises Microsoft infrastructure, contact us at [email protected] or visit Alastor Pulse.
CVE-2026-55040 is a CVSS 9.1 authentication bypass that requires no credentials and impersonates any SharePoint user — apply the July Patch Tuesday updates now, and stage the August RCE patch for immediate deployment the moment it ships.