Threat actors began exploiting CVE-2026-55040 against Microsoft SharePoint on-premises servers on August 12, 2026, less than 24 hours after Rapid7 published its proof-of-concept. The vulnerability, patched on July 14 but publicly disclosed on August 11, enables JWT authentication bypass and impersonation of administrators without credentials. It is the fifth SharePoint flaw exploited in 2026, according to The Hacker News.
- CVE-2026-55040 carries CVSS 9.1 (Critical): allows an unauthenticated remote attacker to forge JWT tokens and impersonate any SharePoint user, including domain administrators.
- The root cause is a chain of four weaknesses in SharePoint's JWT validation pipeline, with
RequireSignedTokens = falseaccepting thealg: nonealgorithm without cryptographic verification. - Rapid7 published the PoC on August 11, 2026; by August 12, Defused Cyber recorded attacks on its honeypots using the exact code.
- SharePoint Server 2016 and 2019 reached end of support on July 14, 2026: unmigrated instances remain permanently exposed, with over 8,500 servers visible on the internet according to Shadowserver.
The Mechanism: Four Steps to Bypass the Entire JWT Chain
Rapid7's research, presented at Pwn2Own Berlin and disclosed to Microsoft on May 18, 2026, decompiled the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes in the Microsoft.SharePoint.IdentityModel.dll DLL. The code reveals four concatenated errors that render token validation ineffective.
The first is the declaration RequireSignedTokens = false, which accepts JWT headers with "alg": "none" without requiring any signature. The second allows resolution of SharePoint's own STS certificate from an unauthenticated metadata endpoint, using the x5t header of the actor token. The third fails to verify that the resolved certificate belongs to TrustedSecurityTokenServices, accepting any issuer. The fourth only checks that the signature is not empty — accepting, for example, "AAAA" — without cryptographic verification.
Stephen Fewer of Rapid7 summarized: an unauthenticated remote attacker can exploit CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server and operate as a site user or administrator. The concatenation turns four flawed checks into a single arbitrary impersonation vector.
From Patch to Fire: A 28-Day Timeline
Microsoft released the fix on July 14, 2026 during its regular Patch Tuesday, with KB 5002882 (build 16.0.19725.20434) for Subscription Edition and 5002883 (build 16.0.10417.20175) for SharePoint Server 2019. The build for SharePoint 2016 is 16.0.5561.1001 via KB5002891. The online version, SharePoint Online, is not affected.
Rapid7 published the full technical analysis and Python PoC on August 11. By the following day, Defused Cyber posted on X: "Attackers are now using the @rapid7 PoC for CVE-2026-55040 against our SharePoint honeypots. The vulnerability is a JWT authentication bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday." Independent confirmation came from SecurityWeek, CybersecurityNews, and HelpNetSecurity.
KEVIntel tracked 12 exploitation attempts from July 19, 2026, with 8 concentrated between August 12 and 13 — the 48 hours immediately following the PoC. The attacks originated from 8 unique IP addresses distributed across five geographic regions: Hong Kong, Japan, the Netherlands, Taiwan, and the United States. The specific identity of the operators and their ultimate objectives have not emerged.
"The authentication feature could be bypassed as this vulnerability allows impersonation. Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system." — Microsoft MSRC advisory
Regulatory Context: RFC 8725 from 2020 Already Banned "alg: none"
The class of JWT vulnerability with the none algorithm has been documented since 2015. The IETF explicitly deprecated it with RFC 8725 in February 2020, recommending that implementations reject this value. The 2026 SharePoint code reintroduced a pattern deemed dangerous for over a decade, making this flaw a case of non-compliance with established standards rather than an offensive research discovery.
The Microsoft MSRC advisory originally classified the vulnerability as "Exploited: No." The status was updated following its addition to the KEV list on August 18, 2026 by CISA, seven days after Defused's honeypot confirmation.
The same authentication chain can be chained with CVE-2026-63520 (CVSS 8.1 HIGH), a separate flaw patched in the August 2026 update, to achieve unauthenticated remote code execution. There is currently no evidence that this RCE chain has been triggered in real-world exploits.
Immediate Actions
- Apply KB5002882, KB5002883, or KB5002891 to all SharePoint Server Subscription Edition, 2019, and 2016 instances still supported; the patched builds are 16.0.19725.20434, 16.0.10417.20175, and 16.0.5561.1001 respectively.
- Verify for anomalous logins in the period July 14 to present, when the patch existed but the flaw was publicly known only after August 11.
- Evaluate migration from SharePoint 2016 and 2019, which reached extended support end on July 14, 2026: these versions will not receive fixes for future vulnerabilities.
- Isolate or place under monitoring on-premises servers exposed directly to the internet, given that Shadowserver detects over 8,500 publicly accessible installations.
Why This Case Raises Questions About the Development Lifecycle
The reappearance of alg: none in a flagship enterprise product in 2026, against consolidated standard recommendations from five years prior, indicates a gap in SharePoint's code security review process. This is not a zero-day vulnerability in the sense of a never-before-seen technique: it is a reimplementation of an archival error, made lethal by the internet visibility of on-premises servers and the speed with which the PoC crossed the research-to-crime boundary.
The transition from available patch to active exploit took roughly four weeks, but the critical window was the August 11-12 interval, when the technical publication provided the missing weapon. The lack of patch adoption in the pre-PoC period, combined with the concurrent end-of-support for versions 2016 and 2019, leaves a significant population of servers in a state of permanent exposure. Shadowserver's data on over 8,500 public installations measures the perimeter, not the impact: the number of successful compromises in production systems is not quantified by available sources.
Sources
- https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
- https://cybersecuritynews.com/microsoft-sharepoint-vulnerability-exploited-2/
- https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/
- https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/
- https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- https://www.techtimes.com/articles/324475/20260814/sharepoint-cve-2026-55040-actively-exploited-attackers-forge-admin-credentials-no-password.htm
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55040
- https://support.microsoft.com/en-us/servicing/office/update/2026/5002882
- https://support.microsoft.com/en-us/servicing/office/update/2026/5002883
Information verified against cited sources and current as of publication.