CVE-2026-55040: SharePoint Authentication Bypass Added to CISA KEV After Public Exploit

CVE-2026-55040 is a critical authentication bypass in on-premises Microsoft SharePoint Server that lets a remote, unauthenticated attacker forge a JSON Web Token and act as any SharePoint user, including a site administrator. It carries a CVSS v3.1 base score of 9.1, and CISA added it to the Known Exploited Vulnerabilities catalog on August 18, 2026 with a federal remediation deadline of August 21. If you run SharePoint Server 2016, 2019, or Subscription Edition on-premises, install the July 2026 security updates today.

What is CVE-2026-55040?

CVE-2026-55040 is a weak authentication vulnerability (CWE-1390) in SharePoint's JWT token validation pipeline. SharePoint accepts bearer service-to-server tokens as proof of identity, and a chain of flaws in how those tokens are parsed and validated allows an attacker to forge one the server treats as legitimate. No credentials, session, or prior access are required.

The vulnerability was discovered by Stephen Fewer, Senior Principal Security Researcher at Rapid7. Rapid7 and Microsoft disclosed it jointly on July 14, 2026. Full technical analysis of the JWT validation flaws was published on August 11, along with a working proof-of-concept script.

CVE-2026-55040 is the first link in a two-vulnerability chain. The second, CVE-2026-63520, is a remote code execution flaw Microsoft patched in its August 2026 updates. Chained, the two produce unauthenticated RCE against a vulnerable SharePoint server. Patching CVE-2026-55040 breaks the chain on its own.

There is one prerequisite. To impersonate a user, the attacker needs that user's identifier in advance, either an Active Directory Security ID or a User Principal Name. That is a thin barrier. UPNs are formatted like email addresses, and SID enumeration is well-trodden ground. The published proof-of-concept enumerates users first, then impersonates the administrator account it finds.

What products and versions are affected?

This affects on-premises SharePoint Server only. SharePoint Online in Microsoft 365 is not in scope.

• Microsoft SharePoint Server Subscription Edition, prior to build 16.0.19725.20434
• Microsoft SharePoint Server 2019, prior to build 16.0.10417.20175
• Microsoft SharePoint Enterprise Server 2016, prior to build 16.0.5561.1001

If you are running any supported on-premises SharePoint farm that has not taken the July 2026 cumulative updates, assume you are affected.

How severe is it?

CVE-2026-55040 carries a CVSS v3.1 base score of 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Network attack vector, low complexity, no privileges required, no user interaction. High confidentiality and integrity impact, no availability impact. Microsoft describes the outcome as an attacker being able to disclose files and modify data without affecting whether the system stays up.

CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, 2026, based on evidence of exploitation in the wild. The remediation due date under BOD 26-04 is August 21, 2026.

Between the July 14 patch and the August 11 technical release, this was a critical but quiet issue. Once working exploit code was public, the window between disclosure and opportunistic scanning collapsed to under a business day. We have seen the same pattern with internet-facing appliances and collaboration platforms, and it is why authentication bypasses deserve same-day work rather than next-cycle work.

Shadowserver has tracked more than 8,500 SharePoint servers reachable from the public internet, though there is no public breakdown of how many are patched.

Are patches available?

Yes. Microsoft shipped fixes in the July 14, 2026 Patch Tuesday release.

• SharePoint Server Subscription Edition: KB5002882, build 16.0.19725.20434
• SharePoint Server 2019: KB5002883, build 16.0.10417.20175
• SharePoint Enterprise Server 2016: KB5002891, build 16.0.5561.1001

Full details are in Microsoft's security advisory for CVE-2026-55040. If you are catching up on SharePoint patching generally, take the August 2026 updates in the same maintenance window so you close CVE-2026-63520 at the same time.

What should you do right now?

1. Patch the July 2026 updates today on every on-premises SharePoint farm. This is a KEV-listed vulnerability with a public exploit and a federal deadline of August 21.
2. Run the SharePoint Products Configuration Wizard after installing updates on every server in the farm. On SharePoint, an installed update is not a completed update until the wizard has run.
3. Verify build numbers directly on the servers. Do not rely on a version string in an HTTP response to confirm patch status. The July fixes advance only the final revision within each product's existing build branch, so any check that resolves version at a coarser level will not distinguish a patched farm from an unpatched one.
4. Inventory your internet-facing SharePoint. CISA's guidance is to avoid exposing SharePoint Server directly to the internet, and where exposure is required, to place it behind a Layer 7 reverse proxy or equivalent control that requires authentication and can inspect and filter requests.
5. Hunt for prior exploitation. An unpatched server has had live-exploit exposure since at least August 11. Review SharePoint ULS logs and IIS logs for anomalous bearer token authentication, unexpected administrative activity, and access from unfamiliar addresses.
6. Check for the rest of the SharePoint cluster. CVE-2026-55040 is one of several SharePoint vulnerabilities CISA has flagged as exploited this summer. A farm behind on July updates is likely behind on more than this one CVE.

How Halo Security can help

The first problem with a vulnerability like this is usually not patching. It is knowing where every SharePoint instance lives. Forgotten extranet farms, a subsidiary's intranet portal, a project site stood up years ago by a team that has since reorganized: these are the assets that miss maintenance windows.

Halo Security's Server Scanning can automatically detect internet-facing servers across your attack surface and identify the software running on them, so you can see which hosts are exposing SharePoint to the internet in the first place. Application Scanning can then assess those web-facing applications for known vulnerabilities and configuration weaknesses.

Pair that external view with an internal build-number check on each server. External scanning tells you where your SharePoint exposure is and what it looks like from an attacker's perspective. Confirming the July update actually applied is a job for the farm itself.

FAQ

Find your SharePoint exposure before someone else does

If you are not certain how many SharePoint servers your organization has facing the internet, that is the question worth answering before the patch window closes. External vulnerability management from Halo Security continuously discovers your internet-facing assets and flags the vulnerabilities that matter, so a forgotten portal does not become the way in. We covered the same discovery problem when a critical OpenSSH flaw exposed millions of servers. Finding the assets came first there too.