CVE-2026-55040: SharePoint JWT Bypass Exploited: No Password Needed

The SharePoint authentication bypass exploits a configuration failure in the JWT validation library used by SharePoint's internal REST API. JWT is a token format widely used for stateless authentication: a client receives a signed token on login and presents it with each subsequent request, allowing the server to verify identity without querying a database on every call.

CVE-2026-55040 exists because SharePoint's token validation code has four checks disabled at the code level. The fields 'ValidateIssuer,' 'ValidateAudience,' 'ValidateLifetime,' and 'RequireSignedTokens' are all set to false. The 'RequireSignedTokens' flag is the critical one: when it is false, the JWT library accepts tokens with an 'alg' header value of 'none,' which means no signature is attached or verified.

An attacker crafting an exploit sends an HTTP request to any SharePoint REST API endpoint, such as /_api/web/currentuser or /_api/lists, with an Authorization header containing a hand-crafted JWT. The token header specifies 'alg: none'. The token payload contains the UPN or SID of a target user, such as a SharePoint site collection administrator. Because SignedTokens validation is disabled, SharePoint accepts the forged token and grants the attacker full access as the impersonated user.

Rapid7's PoC chained CVE-2026-55040 with a second SharePoint vulnerability to demonstrate unauthenticated remote code execution. The companion RCE bug lets the impersonated administrator create or modify SharePoint content in ways that trigger server-side code execution. The full chain requires no credentials at any stage. This attack pattern is similar to what Decryption Digest covered when JetBrains TeamCity CVE-2026-63077 gave unauthenticated RCE to attackers targeting build pipelines.

Any organization running an internet-facing or network-accessible deployment of SharePoint Server Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016 that has not applied July 2026 patches is vulnerable to CVE-2026-55040. SharePoint Server is one of Microsoft's most widely deployed on-premises products, used across financial services, healthcare, government, higher education, legal, and manufacturing sectors for document management, intranet portals, and workflow automation.

The attack requires that the adversary know a valid SharePoint user's identifier, either an Active Directory SID or a User Principal Name. SIDs and UPNs are not secret in most enterprise environments: they appear in email headers, directory listings, LDAP queries, and SharePoint user profile pages. An attacker who can reach the SharePoint server and enumerate one administrator account can immediately impersonate that administrator.

Successful exploitation gives the attacker full access to SharePoint site collections the target user can access. A site collection administrator can read all documents, modify permissions, add users, delete content, and trigger server-side workflows. In the complete RCE chain, access extends to executing arbitrary commands on the SharePoint server itself.

The risk is compounded for organizations that expose SharePoint to the internet for remote workers or partner access. Certificate transparency logs and tools such as Shodan index publicly exposed SharePoint deployments by version. Attackers targeting CVE-2026-55040 can enumerate vulnerable servers and automate exploitation without requiring any pre-existing access or credentials. CISA's KEV listing (which covers all four CVEs added August 18, including CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400) signals that federal agencies face a remediation deadline, but the exposure extends to every sector relying on unpatched on-premises SharePoint.

Exploitation of CVE-2026-55040 began within hours of Rapid7 publishing its detailed technical analysis and proof-of-concept on August 11, 2026. Defused honeypot data captured the first automated attack attempts on August 12, confirming attackers adopted the PoC almost immediately. CISA's August 18 KEV addition confirms the exploitation is widespread enough to require emergency remediation by all U.S. federal civilian executive branch agencies.

The observed attack pattern follows a consistent sequence. Attackers first enumerate the SharePoint server version by queering /_vti_pvt/service.cnf or parsing HTML metadata from the SharePoint login page. Once a vulnerable version is confirmed, they use LDAP enumeration or SharePoint's user profile service to identify administrative accounts. A forged JWT is then submitted to the SharePoint REST API, granting authenticated access. Post-exploitation activity includes SharePoint content exfiltration through the search and download APIs, credential harvesting from SharePoint secrets storage, and in complete-chain attacks, webshell deployment to the SharePoint LAYOUTS directory.

Behavioral indicators to hunt right now include requests to /_api/ and /_layouts/15/ from IP addresses with no prior access history, Authorization headers containing JWTs with an empty or absent signature segment (the third dot-separated component of a JWT is blank when alg=none is used), and file write events in the SharePoint Web Server Extensions directory from w3wp.exe or cmd.exe processes. August 2026 Patch Tuesday addressed both CVE-2026-55040 and the companion RCE flaw, closing both halves of the exploit chain. Organizations running August 2026 Patch Tuesday updates have addressed both components.

Two rules detect post-exploitation behavior following a successful authentication bypass: webshell deployment to the SharePoint layouts directory and webshell process execution via w3wp.exe.

• Log sources: Windows file event and process creation telemetry from the SharePoint server host
• First deployment: Detection-only mode; tune false positives before enabling blocking

For network-layer detection, monitor IIS access logs on SharePoint servers for Authorization headers containing the base64 pattern eyJhbGciOiJub25lIn0 (the encoding of {"alg":"none"}) in requests to /_api/, /_layouts/, or /_vti_bin/ paths. Any JWT submission with an empty third segment is a reliable indicator of an unsigned token. The WAF rules below target this pattern at the network layer.

Patching is the only complete fix for CVE-2026-55040. The workarounds available for some vulnerabilities, such as disabling features or adjusting configuration settings, do not apply here because the JWT validation issue is in compiled SharePoint code.

CVE-2026-55040 SharePoint authentication bypass is not a theoretical risk. Exploitation began within hours of the public PoC release, CISA confirmed active attacks two days later, and the attack requires no credentials, no phishing, and no insider access. Any organization with an unpatched SharePoint Server reachable from the network is a viable target right now.

SharePoint stores documents, workflows, contracts, HR records, project files, and sensitive internal communications for hundreds of thousands of organizations globally. An attacker impersonating a SharePoint administrator can exfiltrate that data silently through SharePoint's native search and download APIs without triggering obvious alerts. In the full RCE chain, the attacker also gains code execution on the SharePoint server itself, which in most deployments sits inside the corporate network with access to Active Directory, file shares, databases, and other internal systems.

The remediation is straightforward: apply the July 2026 patches (KB5002882, KB5002883, or KB5002891 depending on your version) and the August 2026 SharePoint updates. If patching is delayed for any reason, restrict SharePoint network access immediately and deploy the WAF and Sigma detection rules from this post. Treat any authentication activity on SharePoint from August 11 onward as potentially hostile until the server is confirmed patched and clean.

CISA's addition of CVE-2026-55040 to the Known Exploited Vulnerabilities catalog sets a remediation deadline for federal agencies, but the threat applies equally to private sector organizations. The time to patch is before the next exploit scan hits your server, not after.