CISA added CVE-2026-55040, a critical authentication bypass in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on August 18, confirming active exploitation of a flaw that lets unauthenticated attackers impersonate any user on a vulnerable system — including administrators — without a password.
What happened
CVE-2026-55040 (CVSS 9.1) is a weak-authentication flaw in the JWT token validation pipeline used by SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition. Researcher Stephen Fewer of Rapid7, who first demonstrated the bug at Pwn2Own Berlin, found that several weaknesses chained together let an attacker forge a valid JWT and assume the identity of any SharePoint user — provided they can identify a target account via an Active Directory Security ID or User Principal Name, both of which are often easy to enumerate.
Microsoft patched the flaw quietly in its July 14 Patch Tuesday release. Rapid7 published a detailed technical write-up and proof-of-concept exploit on August 11. Exploitation followed almost immediately: honeypot operator Defused reported hits against CVE-2026-55040 within hours, and exploitation-tracking service KEVIntel logged 12 attempts overall, with 8 of those concentrated in the 48 hours after the PoC dropped. CISA’s KEV addition on August 18 formalizes what defenders were already seeing on the wire.
Researchers have also warned the bug can be chained with a second, still-unpatched vulnerability (tracked as CVE-2026-63520) to escalate from authentication bypass to full unauthenticated remote code execution on the SharePoint server itself.
Why it matters
SharePoint’s on-premises footprint remains deep across regulated industries that keep sensitive document workflows off the public cloud for compliance reasons — banks, hospital systems, telecom operators, and government-adjacent contractors among them. An attacker who forges an admin token gets the keys to the document library: the ability to read, exfiltrate, or plant content in every site the impersonated user can reach, plus a foothold for lateral movement into connected Microsoft 365 and Active Directory infrastructure.
Because the bypass requires no credentials and only a guessable identifier, it is well suited to opportunistic, internet-wide scanning rather than a single targeted campaign — the pattern typically seen with ransomware affiliates and initial-access brokers moving fast on a fresh KEV entry to seed access before it dries up.
Recommended actions
- Confirm the July 14, 2026 cumulative update (or later) is applied to all on-premises SharePoint Server 2016, 2019, and Subscription Edition instances; this is a KEV entry with a federal remediation deadline, treat it as urgent regardless of sector.
- Audit SharePoint authentication and admin activity logs since mid-July for anomalous impersonation or privilege-escalation events, particularly around AD SID/UPN lookups.
- Restrict internet exposure of on-premises SharePoint front ends where possible, and place them behind a WAF or reverse proxy with request inspection tuned to the published PoC signatures.
- Rotate credentials and session tokens for accounts with administrative SharePoint roles as a precaution, and monitor for the pending RCE-chaining vulnerability (CVE-2026-63520) once Microsoft issues a fix.
- Treat any internet-facing SharePoint server not yet patched as compromised until log review proves otherwise.