Executive Summary
On August 18, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, ordering all Federal Civilian Executive Branch (FCEB) agencies to apply patches immediately following active in-the-wild exploitation. Tracked with a CVSS v3 score of 9.1, CVE-2026-55040 is a critical authentication bypass in on-premises Microsoft SharePoint Server's JSON Web Token (JWT) validation pipeline.
The vulnerability allows a remote, unauthenticated attacker on the internet to forge valid authentication tokens and log in as any SharePoint user or farm administrator—requiring zero passwords, zero session cookies, and zero user interaction. Threat actors began active exploitation within hours of proof-of-concept (PoC) publication, leveraging the flaw to compromise sensitive enterprise intranets and document repositories.
Deep-Dive Technical Analysis
1. The Four-Flaw Authentication Bypass Chain
Discovered by security researchers at Rapid7 during Pwn2Own research, CVE-2026-55040 is classified under CWE-1390 (Weak Authentication) and consists of four interlocking architectural flaws in SharePoint’s Bearer service-to-service authentication pipeline:
* Outer-Token Signature Check Disabled: SharePoint set RequireSignedTokens to false, causing the token parser to accept outer tokens with alg: none.
* Unverified Actor Token Resolution: The parser resolved the inner actor token's signing key using an attacker-supplied x5t (X.509 certificate SHA-1 thumbprint) header without verifying the signature against a trusted root certificate.
* Improper Issuer Validation: Token issuer validation improperly accepted SharePoint’s own local Security Token Service (STS) certificate because it was absent from the untrusted services list.
* Permissive Signature Verification: The final cryptographic check only required a non-empty signature value rather than mathematically validating the cryptographic hash.
By knowing only an organization's target Active Directory Security Identifier (SID) or User Principal Name (UPN)—both readily discoverable via standard network enumeration—an attacker can forge an administrative JWT that SharePoint validates as fully authorized.
2. Complete Unauthenticated Remote Code Execution (RCE) Chain
CVE-2026-55040 forms the entry point of a complete two-stage unauthenticated RCE chain:
* Stage 1 (Auth Bypass - CVE-2026-55040): The attacker impersonates a SharePoint administrator.
* Stage 2 (RCE - CVE-2026-63520): Leveraging the administrative session, the attacker exploits an unsafe .NET deserialization flaw in SharePoint’s Business Connectivity Services (patched in August 2026), executing arbitrary server-side code under the high-privilege w3wp.exe SharePoint service account.
Industry Impact
* Thousands of Exposed Enterprise Farms: Telemetry indicates over 8,500 on-premises SharePoint servers remain directly accessible via the public internet.
* Mass Document and Intranet Exfiltration: Unauthenticated attackers gain full read, write, and export access to corporate document management systems, contracts, intellectual property, financial records, and personnel data.
* End-of-Support Crisis for 2016/2019: The July 14, 2026 patch marked the final security update for SharePoint Server 2016 and SharePoint Server 2019. Any legacy deployments that fail to migrate face permanent exposure to subsequent zero-day variations.
Recommendations and Mitigation Strategies
1. Apply Cumulative Updates: Apply both the July 2026 update (closing CVE-2026-55040) and the August 2026 update (closing CVE-2026-63520) immediately across all on-premises SharePoint Server Subscription Edition, 2019, and 2016 farms.
2. Remove Public Internet Exposure: Remove on-premises SharePoint servers from direct internet exposure. Place internal web applications behind enterprise VPNs, Zero-Trust Network Access (ZTNA) gateways, or Layer 7 reverse proxies.
3. Web Application Firewall (WAF) Filtering: Deploy WAF rules to inspect and sanitize incoming HTTP Authorization: Bearer headers, blocking requests containing anomalous JWT headers or alg: none directives.
4. Audit Authentication Logs: Search IIS logs and SharePoint Unified Logging Service (ULS) logs for anomalous administrative logins originating from external IP addresses and unverified x5t certificate thumbprints.
5. Accelerate Migration: Establish migration roadmaps to transition legacy on-premises SharePoint 2016/2019 environments to SharePoint Server Subscription Edition or SharePoint Online.