Summary
CVE-2026-55040 is a critical SharePoint authentication bypass that lets unauthenticated attackers impersonate users or administrators. The flaw involves weaknesses in JWT token validation. It affects SharePoint Server 2016, 2019, and Subscription Edition and was fixed in Microsoft’s July 2026 security updates.
Urgent Actions Required
- Patch immediately: Update to the fixed builds: Subscription Edition 16.0.19725.20434 (KB5002882); 2019 16.0.10417.20175 (KB5002883); 2016 16.0.5561.1001 (KB5002891).
- Run PSConfig: Complete the SharePoint farm upgrade on every farm server after installing the updates.
- Monitor for exploitation: Review IIS and ULS logs for suspicious unauthenticated requests, authentication anomalies, and unexpected administrative activity.
- Limit exposure: If patching is delayed, restrict access to exposed SharePoint services using network controls, proxies, or WAFs.
Which Systems Are Vulnerable to CVE-2026-55040?
Technical Overview
- Vulnerability Type: Weak Authentication / Security Feature Bypass via JWT Token Validation
-
Affected Software/Versions:
- SharePoint Enterprise Server 2016: Versions below 16.0.5561.1001
- SharePoint Server 2019: Versions below 16.0.10417.20175
- SharePoint Server Subscription Edition: Versions below 16.0.19725.20434
-
CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
-
Patch Availability: Yes, available
- SharePoint Enterprise Server 2016:Microsoft Update Catalog
- SharePoint Server 2019:Microsoft Update Catalog
- SharePoint Server Subscription Edition:Microsoft Update Catalog
How Does the CVE-2026-55040 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-55040?
Vulnerability Root Cause:
The flaw is caused by weaknesses in SharePoint’s JWT token validation. Forged tokens can bypass authentication, allowing attackers to impersonate known users, including administrators, and act with their permissions.
How Can You Mitigate CVE-2026-55040?
If immediate patching is delayed or not possible:
- Restrict SharePoint network access to reduce exposure to untrusted sources.
- Use a WAF or reverse proxy to filter suspicious authentication requests and malformed JWTs.
- Limit access to exposed SharePoint endpoints through network controls or trusted IP restrictions.
- Monitor IIS and ULS logs for unusual unauthenticated requests and privileged account activity.
- Review SharePoint access and permission changes for signs of unauthorized activity.
Which Assets and Systems Are at Risk?
-
Business-Critical Systems at Risk:
- Enterprise collaboration platforms - SharePoint sites, documents, lists, and other business content may be accessed or modified
- SharePoint administrative functions - Attackers may impersonate a site administrator and perform actions with elevated permissions
- Internal file-sharing and workflow environments - SharePoint deployments containing sensitive business information can be targeted
-
Exposure Level:
- Internet-facing SharePoint farms - These have the highest exposure to remote unauthenticated attacks
- Extranet deployments - SharePoint services accessible from external networks may face increased attack risk
- Internal SharePoint farms - Still at risk when an attacker gains network access to the environment
Will Patching CVE-2026-55040 Cause Downtime?
Patch application impact: Low. Install the applicable SharePoint update and run PSConfig on every farm server. Brief service disruption may occur during the upgrade.
How Can You Detect CVE-2026-55040 Exploitation?
Exploitation Signatures:
Look for suspicious SharePoint requests containing forged JWTs, including tokens using alg: none, unexpected x5t values, or unverified signatures.
Indicators of Compromise (IOCs/IOAs):
- Unauthenticated requests targeting SharePoint authentication or S2S endpoints
- Requests to /_vti_bin/client.svc or /_layouts/15/metadata/json/1
- JWTs using alg: none or suspicious token-signing data
- Unexpected access or changes involving privileged SharePoint accounts
Behavioral Indicators:
- Anonymous requests receiving successful responses from protected SharePoint functionality
- Known user or administrator identities appearing without corresponding authentication
- Unexpected document, permission, or site collection changes
- Unusual outbound connections from SharePoint web front ends
Alerting Strategy:
-
Priority: Critical
- Alert on suspicious unauthenticated SharePoint requests and forged JWT characteristics
- Investigate anomalous privileged-account activity following unauthenticated access
Remediation & Response
-
Remediation Timeline:
- Immediately: Apply the applicable Microsoft security update
- After patching: Run PSConfig or the SharePoint Products Configuration Wizard on every farm server
- After remediation: Verify patch levels across all farm servers and review logs for suspicious activity
-
Incident Response Considerations:
- Review IIS and ULS logs for suspicious unauthenticated requests and abnormal authentication activity
- Investigate privileged-account activity for unexpected access or changes to documents, permissions, or site collections
- Check SharePoint endpoints for suspicious requests involving forged or malformed JWTs
- Assess exposed farms and affected servers and ensure all vulnerable installations have been patched
Get Deeper Visibility and Faster Response Across Every Endpoint
-
-
- See how Fidelis Endpoint® detects and responds to advanced threats
- Investigate managed and unmanaged endpoints remotely
- Reduce alert fatigue and accelerate incident response
- Identify vulnerabilities and stop malware faster
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.1 | High-impact vulnerability that can enable unauthorized access and data modification |
| Attack Vector | Network | Exploitable remotely against an affected SharePoint Server |
| Attack Complexity | Low | Exploitation does not depend on complex conditions |
| Privileges Required | None | The attacker does not need valid credentials to exploit the flaw |
| User Interaction | None | Exploitation requires no action from a user |
| Scope | Unchanged | The impact remains within the vulnerable SharePoint security context |
| Confidentiality Impact | High | Successful exploitation can expose protected SharePoint information |
| Integrity Impact | High | Attackers can perform unauthorized actions, including modifying SharePoint content |
| Availability Impact | None | The vulnerability does not directly affect service availability |
References:
