Vulnerability Analysis

CVE-2026-55040: Microsoft SharePoint JWT Authentication Bypass — What It Is & How to Fix It

Executive Summary

CVE-2026-55040 is a critical (CVSS 9.1) JWT token authentication bypass in Microsoft SharePoint Server that allows a remote, unauthenticated attacker to impersonate any user — including site administrators — with no credentials required. Discovered by Rapid7 and demonstrated at Pwn2Own Berlin 2026, this flaw can be chained with a second, still-unpatched vulnerability to achieve full unauthenticated remote code execution. Microsoft patched the authentication bypass component on July 14, 2026 (Patch Tuesday); the RCE half of the chain is expected in August 2026. Organizations running unpatched SharePoint Server installations should treat this as an emergency remediation priority.

1. What Is This Vulnerability?

SharePoint uses JSON Web Tokens (JWTs) to represent authenticated user identity across its internal request pipeline. CVE-2026-55040 is rooted in multiple weaknesses in SharePoint's JWT token validation pipeline (CWE-1390: Weak Authentication). Because the server fails to rigorously verify the integrity and origin of these tokens, an attacker can forge a token that the server accepts as legitimate — without ever needing a valid password, certificate, or session cookie.

The core mechanics: to impersonate a target user, the attacker needs only one piece of identity information — either the target's Active Directory Security Identifier (SID) or their User Principal Name (UPN) (formatted like an email address, e.g. admin@contoso.com). Both pieces of information are frequently discoverable via SID enumeration, LDAP queries, or basic social engineering, making the barrier to exploitation very low.

Rapid7's proof-of-concept demonstrates the attack in a tight loop: enumerate potential user SIDs from the SharePoint environment, forge a JWT for the target SID, and submit authenticated requests as that user. The entire process requires no prior foothold on the network — only HTTP access to the SharePoint server's public-facing endpoint.

Attack Vector

The attack flow looks like this:

  1. Reconnaissance — Attacker enumerates valid AD SIDs or UPNs from the target SharePoint site (via publicly exposed user profile pages, /_api/web/siteusers, LDAP, or passive OSINT).
  2. Token Forgery — Attacker crafts a malformed/forged JWT embedding the target's SID or UPN, exploiting flaws in SharePoint's token validation to bypass signature verification.
  3. Impersonation — Attacker submits the forged token in HTTP requests; SharePoint's backend treats the attacker as the impersonated user.
  4. Privilege Escalation — Once impersonating a site administrator, the attacker has full access to documents, workflows, list data, and the SharePoint Central Administration interface.
  5. RCE Chain (Unpatched) — The auth bypass is then chained with a second vulnerability (pending August 2026 patch) to achieve unauthenticated remote code execution on the SharePoint server.

Real-World Impact

Rapid7 disclosed this vulnerability to Microsoft on May 18, 2026, after developing it as a Pwn2Own Berlin 2026 entry. Notably, the research used AI-assisted code review over 96 agentic sessions and ~80,000 tool calls across a two-sprint effort — a sign of how AI is accelerating offensive security research. Microsoft confirmed the findings and fast-tracked a patch for the auth bypass component.

No public exploitation in the wild has been confirmed as of this writing, but given that Rapid7's PoC is complete and technical details are expected within 30 days of July 14, weaponized exploits should be anticipated in the near term.

2. Who Is Affected?

Product Patch KB Support Status
SharePoint Server Subscription Edition KB5002882 Active support
SharePoint Server 2019 KB5002883 End of Extended Support: July 14, 2026
SharePoint Server 2016 KB5002891 End of Extended Support: July 14, 2026

SharePoint Online (Microsoft 365) is NOT affected. Microsoft cloud-hosted SharePoint has already been patched server-side.

A critical complication: SharePoint Server 2016 and 2019 both reached the end of their extended support lifecycle on July 14, 2026 — the same date these patches were released. These are the final security updates these versions will ever receive. Any new vulnerabilities discovered after July 14 will go unpatched on 2016 and 2019 installations. Organizations running these versions are in an increasingly exposed position and should prioritize migration to Subscription Edition or SharePoint Online.

Factors that increase risk:

  • SharePoint server reachable from the internet (internet-facing deployment)
  • Active Directory user SIDs or UPNs discoverable externally (public user profiles, email addresses matching UPN format)
  • Central Administration exposed on the same network segment
  • No WAF or network-layer controls in front of SharePoint

3. How to Detect It (Testing)

Manual Testing Steps

These steps help you confirm whether your SharePoint instance is running the vulnerable (unpatched) version:

  1. Check the SharePoint build version by navigating to /_vti_pvt/buildversion.cnf or via Central Administration → Servers in Farm.
  2. Compare the build number against the patched builds listed in the applicable KB article (KB5002882, KB5002883, or KB5002891). A build number lower than the patched build indicates vulnerability.
  3. Check patch installation via PowerShell (see command below).
  4. Attempt unauthenticated API access: From an unauthenticated session, send a request to /_api/web/currentuser — a properly configured server should return a 401 or redirect to login. This alone does not confirm the vulnerability but establishes a baseline.
  5. Review SharePoint ULS logs at %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\LOGS for anomalous authentication events (unexpected JWT token validations from unknown IP ranges).

Automated Scanning

Tool: Tenable / Nessus (InsightVM)

Rapid7's InsightVM and Nexpose received authenticated vulnerability checks for CVE-2026-55040 in the July 14 content release. Run an authenticated scan against your SharePoint servers and check for this CVE in the findings.

Tool: Microsoft Security Compliance Toolkit / MBSA

Use Get-SPProduct in the SharePoint Management Shell to verify installed patches:

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

# Get the installed SharePoint patches
$farm = Get-SPFarm
$farm.BuildVersion

# Check whether the specific patch is installed
Get-SPProduct -Local | Select-Object DisplayName, PatchedVersion

Expected output for patched systems:

  • Subscription Edition: Build 16.0.17928.20000 or higher (per KB5002882)
  • SharePoint 2019: Build 16.0.10416.20000 or higher (per KB5002883)
  • SharePoint 2016: Build 16.0.5495.1000 or higher (per KB5002891)

Tool: Windows Update/WSUS

# Check for installed KBs
Get-HotFix -Id KB5002882  # Subscription Edition
Get-HotFix -Id KB5002883  # 2019
Get-HotFix -Id KB5002891  # 2016

A result returning the hotfix entry confirms the patch is installed.

Code Review Checklist

If you maintain custom SharePoint code or extensions, review for patterns that rely on JWT token validation logic:

  • Verify all custom authentication providers properly validate JWT signature, not just token format
  • Confirm custom web parts do not re-implement token parsing that could be influenced by forged claims
  • Check that any SharePoint Add-ins using OAuth do not trust sub claims without server-side verification
  • Review any custom HttpModules or SPHttpHandler implementations that process auth headers

4. How to Fix It (Mitigation)

Step-by-Step Remediation

For organizations with a functional patching pipeline:

  1. Verify your SharePoint version (2016, 2019, or Subscription Edition) using SharePoint Central Administration → Upgrade and Migration → Review database status.
  2. Download the correct KB update from the Microsoft Update Catalog:
  3. Install prerequisites — ensure the prerequisite cumulative updates for the current month are installed before applying the security update.
  4. Run the SharePoint Products Configuration Wizard (or psconfig.exe -cmd upgrade -inplace b2b -wait) after installing the update to propagate configuration changes across the farm.
  5. Verify all servers in the farm are updated — in multi-server farms, the patch must be applied to every SharePoint server and the configuration wizard run on each.
  6. Validate build versions using the PowerShell commands above after the upgrade completes.

Network-Layer Mitigations (if immediate patching is not possible)

If you cannot patch immediately, reduce your attack surface:

# Example: Restrict SharePoint to trusted IP ranges via Windows Firewall
New-NetFirewallRule -DisplayName "Block External SharePoint" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress "0.0.0.0/0" -Action Block

New-NetFirewallRule -DisplayName "Allow Internal SharePoint" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16" -Action Allow
  • Disable external access to SharePoint Central Administration (port 2013 or configured admin port) — this should never be internet-facing.
  • Deploy a WAF rule to detect and block requests containing anomalous Authorization: Bearer headers without a valid OAuth flow (look for tokens with unusual alg or iss claims).
  • Enable Modern Authentication / restrict legacy auth to reduce attack surface on the JWT pipeline.
  • Monitor SharePoint ULS logs for authentication events originating from unexpected IP ranges or with malformed token payloads.

Configuration Hardening

# Disable anonymous access at the farm level
$zone = [Microsoft.SharePoint.Administration.SPUrlZone]::Default
$webApp = Get-SPWebApplication "https://sharepoint.contoso.com"
$webApp.IisSettings[$zone].AllowAnonymous = $false
$webApp.Update()

# Ensure Claims-based Authentication is enforced
$webApp.UseClaimsAuthentication
# Should return: True

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A: Confirm that authenticated users can still access SharePoint normally with valid credentials.
  • Scenario B: Confirm that requests with no Authorization header (unauthenticated) correctly return HTTP 401 from SharePoint endpoints.
  • Scenario C: Confirm that document libraries, lists, and user profile data remain accessible to authorized users post-patch.
  • Scenario D: Confirm that SharePoint workflows and Add-ins continue to authenticate correctly via OAuth.

Security Test Cases

Test Case 1: Verify unauthenticated access is blocked

  • Precondition: Apply the July 2026 security patches
  • Steps: Send a request to GET /_api/web/currentuser with no Authorization header
  • Expected Result: HTTP 401 Unauthorized (not a valid user identity response)

Test Case 2: Verify forged token is rejected

  • Precondition: Apply patch; have access to a known user SID
  • Steps: Craft a JWT with a known SID in the sid claim and an invalid/missing signature; submit as Authorization: Bearer <forged_token>
  • Expected Result: HTTP 401 or 403; server does not return user identity data or perform actions as the target user

Test Case 3: Verify legitimate OAuth tokens still work

  • Precondition: Apply patch; have a registered SharePoint Add-in with valid app credentials
  • Steps: Complete a proper OAuth authorization code flow; use the resulting access token
  • Expected Result: HTTP 200 with correct user context

Automated Tests

# Quick smoke test: verify unauthenticated requests return 401
$response = Invoke-WebRequest -Uri "https://sharepoint.contoso.com/_api/web/currentuser" `
  -UseBasicParsing -ErrorAction SilentlyContinue

if ($response.StatusCode -eq 401) {
    Write-Host "PASS: Unauthenticated access correctly blocked (401)" -ForegroundColor Green
} elseif ($response.StatusCode -eq 200) {
    Write-Host "FAIL: Unauthenticated access returned user data - server may be unpatched or misconfigured" -ForegroundColor Red
} else {
    Write-Host "INCONCLUSIVE: Received HTTP $($response.StatusCode)" -ForegroundColor Yellow
}

6. Prevention & Hardening

Best Practices

  • Patch on Patch Tuesday cadence — Microsoft's monthly patch cycle is the primary defense for SharePoint Server. Subscribe to the Microsoft Security Update Guide for advance notice of upcoming patches.
  • Migrate off end-of-life versions — SharePoint 2016 and 2019 are now past extended support. Future vulnerabilities in these versions will go unpatched. Begin migration planning to SharePoint Server Subscription Edition or SharePoint Online immediately.
  • Never expose SharePoint to the internet without a WAF — CVE-2026-55040 is network-exploitable with no authentication, making internet-facing instances extremely high risk.
  • Follow least-privilege for SharePoint roles — Limit the number of users with site collection administrator privileges. A successful impersonation attack using a low-privilege user SID is far less damaging than one impersonating a farm administrator.
  • Rotate and audit service accounts — Review which service accounts have elevated SharePoint permissions and apply the principle of least privilege.
  • Enable SharePoint audit logging — Track access to sensitive document libraries and site administration functions. Unusual access patterns (admin actions from odd hours or unknown IPs) may indicate exploitation.

Monitoring & Detection

Deploy the following detections to catch exploitation attempts:

SIEM / Log Correlation (SharePoint ULS Logs):

  • Alert on authentication events where token source IP is outside expected corporate IP ranges
  • Alert on rapid successive authentication attempts against multiple user SIDs (enumeration behavior)
  • Alert on /_api/ endpoint requests arriving without a valid prior session cookie
  • Alert on Central Administration access from non-admin network segments

Network-level detection:

  • Flag HTTP requests to SharePoint with Authorization: Bearer headers where the token payload contains unusual claim structures (missing nonce, unexpected iss values, or alg: none)
  • Alert on port scanning activity targeting SharePoint ports (80, 443, 2013) from external IP ranges

Windows Event Logs:

  • Monitor Event ID 4625 (failed logon) on SharePoint servers — a spike may indicate credential-stuffing attempts or auth bypass probing
  • Monitor Event ID 4672 (special privilege logon) for unexpected administrative access to SharePoint-related accounts

References

Latest from the blog

See all →