Weak authentication in Microsoft Office SharePoint

CVE-2026-55040 is a JWT token validation bypass in SharePoint Server's authentication pipeline. A remote, unauthenticated attacker can forge a token that impersonates *any* SharePoint site user — including administrators — provided they know the target's Active Directory SID or User Principal Name (UPN). UPNs are usually just [email protected], which makes the 'prerequisite' about as restrictive as knowing someone's email. Affected products are SharePoint Server Subscription Edition, 2019, and 2016; fixed via the July 2026 Patch Tuesday cumulative updates.

The vendor CRITICAL / 9.1 rating is accurate and if anything understates the operational risk. Rapid7 disclosed this as the *first half* of a Pwn2Own Berlin 2026 chain — the paired RCE bug is scheduled for the August 2026 Patch Tuesday. Patching CVE-2026-55040 today breaks the full chain, but once August drops (or once someone else finds the RCE half independently, or once Rapid7 publishes technical details in 30 days), on-prem SharePoint becomes a repeat of the 2025 ToolShell fire drill. Treat this as pre-weaponized.

Why this verdict

• Pre-auth, network, no user interaction — the only prerequisite is knowing a UPN, which is functionally an email address. This is the lowest-friction precondition class.
• Role multiplier — SharePoint farm accounts are AD-integrated by definition. Successful impersonation of a site admin plus farm-account credential extraction ends in domain compromise; this is the canonical high-value-role outcome and floors the verdict at CRITICAL.
• Publicly telegraphed exploit chain — Rapid7's disclosure explicitly states the paired RCE is coming in August and technical details drop in ~30 days. Defenders have weeks, not months.
• Broad exposed population — ~10-16k internet-facing on-prem farms per Censys/Shodan, and internal-only farms multiply the fleet target significantly.
• No friction downgrades apply. WAFs don't have signatures yet, MFA lives above the token layer (not below it), and the vuln bypasses the entire auth stack.

Why not higher?

There is no higher bucket than CRITICAL. Score capped at 9.3 rather than 10.0 because as a standalone bug it grants impersonation, not code execution — the RCE step is not yet public. Once the August RCE ships or the PoC drops, effective score for unpatched farms is 10.0.

Why not lower?

Downgrading to HIGH would require either narrow deployment (SharePoint is ubiquitous), meaningful precondition friction (knowing a UPN is not friction), or absence of a plausible pivot to fleet compromise (farm accounts pivot to AD). None of those apply. The 'requires internal network' argument fails because Censys sees ~10k farms on the public internet.

1. Deploy the July 2026 Patch Tuesday SharePoint CU and run PSConfig on every farm within 3 days — This is the vendor fix and the only durable control. Per the noisgate mitigation SLA for CRITICAL, deployment must complete within 3 days. SharePoint patches are not complete until PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures runs on every server in the farm.
2. Pull internet-facing SharePoint farms off the public internet or front them with a WAF in blocking mode — Restrict TCP/443 to VPN/ZTNA/corporate ranges only. If exposure is required, enable F5/Akamai/Cloudflare virtual patches once signatures ship. This buys time while patches propagate through change control.
3. Rotate SharePoint machine keys, farm account credentials, and any service principal secrets after patching — Assume compromise on any farm that was internet-reachable during the 2025 ToolShell window OR any farm not patched within 72 hours of this CVE. Machine key theft was the ToolShell endgame and will be reused here.
4. Convert farm accounts to gMSA where possible — Group Managed Service Accounts prevent credential extraction from LSASS/registry, breaking the SharePoint → AD pivot path that gives this bug its blast radius.
5. Enable AMSI integration and constrained language mode on SharePoint servers — SharePoint has native AMSI support since the September 2023 CU. Turn it on now to catch the RCE half when it lands. Set Set-SPSecurityHardeningPolicy -EnableAMSI $true.

Run this on each SharePoint farm server as a local administrator with the SharePoint Management Shell loaded. Invoke: .\Check-CVE-2026-55040.ps1. It reads the farm build number and compares against the July 2026 CU fixed versions per Microsoft's advisory. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -Version 5.1
# Check-CVE-2026-55040.ps1
# Detects whether the local SharePoint farm has the July 2026 CU applied.
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }
} catch {
    Write-Output 'UNKNOWN: SharePoint PowerShell snap-in not available — not a SharePoint server?'
    exit 2
}

# Fixed builds per Microsoft July 2026 SharePoint updates.
# Update these if MSRC publishes revised build numbers.
$fixedBuilds = @{
    '16.0.10417' = [Version]'16.0.10417.20050'   # SharePoint Server Subscription Edition
    '16.0.10416' = [Version]'16.0.10416.20050'   # SPSE prior baseline
    '16.0.10415' = [Version]'16.0.10415.20050'
    '16.0.10395' = [Version]'16.0.10395.20050'   # SharePoint Server 2019
    '16.0.4999'  = [Version]'16.0.4999.1000'     # SharePoint Server 2016
}

try {
    $farm = Get-SPFarm
    $build = [Version]$farm.BuildVersion
    Write-Output "Detected farm build: $build"

    $majorMinorBuild = "$($build.Major).$($build.Minor).$($build.Build)"
    if ($fixedBuilds.ContainsKey($majorMinorBuild)) {
        $required = $fixedBuilds[$majorMinorBuild]
        if ($build -ge $required) {
            Write-Output "PATCHED: build $build meets or exceeds $required"
            exit 0
        } else {
            Write-Output "VULNERABLE: build $build is below required $required — apply July 2026 CU and run PSConfig"
            exit 1
        }
    } else {
        Write-Output "UNKNOWN: unrecognized SharePoint branch $majorMinorBuild — verify manually against MSRC advisory for CVE-2026-55040"
        exit 2
    }
} catch {
    Write-Output "UNKNOWN: failed to read farm build — $($_.Exception.Message)"
    exit 2
}

Sources

1. Rapid7 disclosure — CVE-2026-55040 JWT auth bypass
2. Rapid7 Patch Tuesday — July 2026
3. CISA — SharePoint hardening guidance (2026-07-14)
4. ZDI — July 2026 Security Update Review
5. Talos — Microsoft Patch Tuesday July 2026
6. The Hacker News — Microsoft patches 622 flaws
7. Censys — SharePoint exposure telemetry (context)
8. Shodan Internet Exposure Dashboard