Loading story…
Microsoft and Rapid7 disclosed CVE-2026-55040, an authentication bypass flaw in Microsoft SharePoint that allows a remote, unauthenticated attacker to impersonate a SharePoint site user or administrator. Rapid7 said the issue originates in SharePoint’s JWT token validation pipeline, aligning with the broader CWE-1390 Weak Authentication class in which identity checks fail to adequately verify a claimed user and can lead to unauthorized access and privilege abuse.
Microsoft has issued SharePoint updates addressing CVE-2026-55040, while Rapid7 reported the bug can be chained with a separate SharePoint remote code execution vulnerability to achieve unauthenticated RCE. Microsoft scored the authentication bypass at CVSS 5.3 and said the RCE component is planned for a later update cycle; Rapid7 noted that fixing the JWT flaw breaks the exploit chain that was developed during zero-day research for Pwn2Own Berlin.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a SharePoint update that fixed CVE-2026-55040, according to Rapid7's disclosure and Microsoft's SharePoint updates page. Rapid7 noted Microsoft planned to address the separate RCE component in the August 2026 update cycle.
Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability in Microsoft SharePoint that can allow a remote unauthenticated attacker to impersonate a SharePoint site user or administrator. Rapid7 said the flaw stems from multiple issues in the JWT token validation pipeline and that fixing it breaks an unauthenticated RCE exploit chain.
Rapid7 reported that the successful exploit chain emerged during its March 2026 research sprint. The chain combined the JWT authentication bypass with a separate SharePoint remote code execution issue.
Rapid7 said it used agentic AI-assisted research on SharePoint during a January 2026 research sprint as part of the work that eventually led to the exploit chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
rapid7.com
Open sourcelearn.microsoft.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 and Microsoft disclosed **`CVE-2026-63520`**, a high-severity remote code execution flaw in Microsoft SharePoint that can be chained with the previously disclosed authentication bypass **`CVE-2026-55040`** to achieve **unauthenticated RCE** on vulnerable on-premises SharePoint servers. The chain affects supported SharePoint versions and also impacts certain versions of Microsoft Project Server and Microsoft Office Web Apps Server, with the initial authentication bypass also reported to affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft advised customers to apply the latest updates, and Rapid7 said July updates disrupted the exploit chain while the RCE fix was disclosed separately. Rapid7 said **`CVE-2026-55040`** lets attackers forge JWTs and impersonate SharePoint users or administrators by exploiting multiple weaknesses in SharePoint's token validation pipeline, including inadequate signature enforcement and certificate validation. Attackers can obtain the SharePoint STS signing certificate from an unauthenticated metadata endpoint, craft forged nested JWTs, and access authenticated endpoints before using **`CVE-2026-63520`** in Business Connectivity Services, where unsafe .NET type instantiation enables arbitrary code execution under the SharePoint Site service account. Researchers said the exploit chain was developed during a zero-day research project using AI-assisted workflows, while noting that expert oversight was required throughout the discovery process.
Aug 26, 2026
Threat actors are actively exploiting **CVE-2026-55040**, a critical Microsoft SharePoint authentication bypass flaw with a **CVSS score of 9.1**, after public proof-of-concept code was released. The vulnerability, patched by Microsoft in July 2026, affects SharePoint Server Subscription Edition and allows unauthenticated attackers to forge JWTs, bypass authentication, and impersonate any SharePoint user, including administrators. Researchers said the bug chain stems from multiple weaknesses in SharePoint’s JWT validation pipeline, including acceptance of an outer token using `alg: none` and failures to properly verify certificate trust and token signatures. Security researchers and honeypot operators reported a sharp rise in exploitation attempts immediately after the PoC became public, with telemetry showing 12 attempts since July 19 and most activity concentrated on August 12 and 13. Successful attacks can expose documents, enable data modification across a SharePoint farm, and provide a foothold for broader compromise of connected Microsoft 365 environments, increasing urgency for organizations to apply Microsoft’s patch and review SharePoint access for signs of abuse.
Aug 13, 2026
Microsoft’s August security updates completed remediation of a two-vulnerability unauthenticated remote code execution chain in on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The chain combines `CVE-2026-55040`, an authentication bypass flaw patched in July with a CVSS score of 9.1, and `CVE-2026-63520`, the code-execution component patched in August. According to reporting cited by CERT Uganda, attackers can chain the flaws to forge a JSON Web Token, impersonate any SharePoint user or administrator, and gain full unauthenticated remote code execution. Active exploitation of `CVE-2026-55040` was confirmed in August, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with an urgent remediation deadline. The SharePoint fixes landed amid Microsoft’s July 2026 security release, which addressed a record 570 vulnerabilities including two actively exploited zero-days. Organizations that applied only the July SharePoint update remain exposed to the full attack chain until the August cumulative update is installed.
Aug 20, 2026