CVE-2026-55040
Microsoft SharePoint Weak Authentication Vulnerability
Description
CVE-2026-55040 is a critical weak authentication vulnerability in Microsoft Office SharePoint that allows an unauthorized, remote attacker to bypass a security feature over a network. The flaw stems from insufficient verification of a claimed identity — reported as a JWT token authentication bypass — enabling an attacker to gain access without valid credentials. Successful exploitation of this SharePoint vulnerability compromises the confidentiality and integrity of the affected server, exposing documents and enabling unauthorized changes. With a CVSS score of 9.1, public exploit code available, and inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-55040 is an urgent patching priority for on-premises SharePoint Server deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20434; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040(Patch, Vendor Advisory)
- https://github.com/sfewer-r7/CVE-2026-55040(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040(Exploit, Third Party Advisory)
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/(US Government Resource)
Weakness Type
CWE-1390: Weak Authentication
Weak authentication occurs when a product implements an authentication mechanism but fails to sufficiently verify that a claimed identity is genuine, letting attackers bypass it faster or with less effort than intended. In CVE-2026-55040 the SharePoint authentication logic can be circumvented — via a JWT token bypass — so that an unauthorized network attacker is treated as a legitimate user without presenting valid credentials.
Learn more: CWE-1390 — Weak Authentication
Impact Analysis
The impact of CVE-2026-55040 is severe because it is remotely exploitable over the network with low attack complexity, requires no privileges, and needs no user interaction, so an attacker can bypass authentication with a single crafted request. Exploitation yields high impact to confidentiality and high impact to integrity — the attacker can read protected SharePoint content and tamper with data or configuration — while availability is not directly affected. Because SharePoint often stores an organization's sensitive documents and serves as a collaboration hub, an authentication bypass here can expose business-critical information and enable further intrusion. Rated CVSS 9.1 (Critical) with an EPSS score of roughly 5.5% (92nd percentile) and confirmed active exploitation per CISA, the vulnerability presents a high and immediate risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-55040 by adding it to the Known Exploited Vulnerabilities catalog, and public exploit code is available for this vulnerability via sfewer-r7/CVE-2026-55040 on GitHub, with a technical analysis of the JWT token authentication bypass published by Rapid7. The availability of a public proof-of-concept dramatically lowers the barrier to exploitation and, combined with an EPSS score of about 5.5% (92nd percentile), signals a high likelihood of continued attack activity. The KEV ransomware flag is "Unknown," but the ready availability of exploit code against a widely deployed, high-value target means defenders should patch without delay and assume opportunistic exploitation is underway.
Remediation
- Apply Microsoft's security update immediately. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and comply with BOD 26-04 guidance; if fixes are unavailable, discontinue use of the product.
- Upgrade to the patched SharePoint build. Update SharePoint Server to at least build 16.0.19725.20434 (or later), and ensure the corresponding fixes are applied to SharePoint Server 2016 and 2019 deployments.
- Harden authentication and restrict exposure. Because the flaw is a token/authentication bypass, limit external exposure of SharePoint, place it behind strong authentication gateways, and enforce robust, industry-standard authentication controls in line with CWE-1390 guidance.
- Hunt for signs of unauthorized access. Review SharePoint and authentication logs for anomalous token usage, unexpected privileged actions, or access from unfamiliar sources, and rotate any secrets that could have been exposed.
- Reduce long-term risk by keeping on-premises SharePoint patched promptly and monitoring vendor advisories for follow-on fixes.
Technical Details
CVE-2026-55040 is a weak authentication issue (CWE-1390) in Microsoft SharePoint: the server implements an authentication mechanism but does not sufficiently verify the claimed identity, and public analysis characterizes the flaw as a JWT token authentication bypass. An attacker who can craft or manipulate the token material can satisfy the weak check and be treated as an authenticated principal. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N shows the attack is network-reachable, low-complexity, and requires neither privileges nor user interaction, which is why a remote attacker can bypass the security feature and obtain high-impact read and write access to protected SharePoint resources without ever supplying valid credentials.
Frequently Asked Questions
Is CVE-2026-55040 being actively exploited?
Yes. CISA has added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog, confirming active exploitation, and public exploit code is available. Its EPSS score of about 5.5% (92nd percentile) further indicates elevated exploitation likelihood.
What products are affected by CVE-2026-55040?
The vulnerability affects Microsoft SharePoint Server, including builds before 16.0.19725.20434 as well as SharePoint Server 2016 and 2019. On-premises SharePoint deployments running these versions are at risk.
How do I fix CVE-2026-55040?
Apply Microsoft's security update to reach at least SharePoint build 16.0.19725.20434, and ensure the fix is applied across SharePoint Server 2016 and 2019. Restrict external exposure, hunt for signs of unauthorized token use, and follow CISA's KEV/BOD 26-04 guidance.
How severe is CVE-2026-55040?
It is Critical, with a CVSS 3.1 base score of 9.1. The flaw is unauthenticated, network-exploitable, requires no user interaction, and causes high confidentiality and integrity impact; combined with a public exploit and an EPSS score in the 92nd percentile, it is a top-priority fix.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.