Microsoft SharePoint Server JWT Token Authentication Bypass

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the local SharePoint Server is patched against CVE-2026-55040.
.DESCRIPTION
    Queries the SharePoint farm build version via the SharePoint snap-in and compares
    against patched build thresholds for SP2016, SP2019, and SPSE.
.OUTPUTS
    VULNERABLE | PATCHED | UNKNOWN
.NOTES
    Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    # Load SharePoint PowerShell snap-in if not already loaded
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }

    $farm = Get-SPFarm -ErrorAction Stop
    $bv = $farm.BuildVersion
    Write-Host "SharePoint Build Version: $bv"

    if ($bv.Major -ne 16) {
        Write-Host "UNKNOWN - Unexpected major version: $($bv.Major)"
        exit 2
    }

    $result = 'UNKNOWN'

    # SharePoint Server Subscription Edition (build 19xxx)
    if ($bv.Build -ge 19000) {
        Write-Host 'Product: SharePoint Server Subscription Edition'
        # Patched: KB5002882 = build 16.0.19725.20434
        if ($bv.Build -gt 19725 -or ($bv.Build -eq 19725 -and $bv.Revision -ge 20434)) {
            $result = 'PATCHED'
        } else {
            $result = 'VULNERABLE'
        }
    }
    # SharePoint Server 2019 (build 10xxx)
    elseif ($bv.Build -ge 10000) {
        Write-Host 'Product: SharePoint Server 2019'
        # Patched: KB5002883 = build 16.0.10417.20175
        if ($bv.Build -gt 10417 -or ($bv.Build -eq 10417 -and $bv.Revision -ge 20175)) {
            $result = 'PATCHED'
        } else {
            $result = 'VULNERABLE'
        }
    }
    # SharePoint Enterprise Server 2016 (build 5xxx)
    elseif ($bv.Build -ge 5000) {
        Write-Host 'Product: SharePoint Enterprise Server 2016'
        # Patched: KB5002891 = build 16.0.5561.1001
        if ($bv.Build -gt 5561 -or ($bv.Build -eq 5561 -and $bv.Revision -ge 1001)) {
            $result = 'PATCHED'
        } else {
            $result = 'VULNERABLE'
        }
    }
    else {
        Write-Host "UNKNOWN - Unrecognized SharePoint build: $bv"
        exit 2
    }

    Write-Host $result
    if ($result -eq 'VULNERABLE') { exit 1 }
    elseif ($result -eq 'PATCHED') { exit 0 }
    else { exit 2 }
}
catch {
    Write-Host "UNKNOWN - Error querying SharePoint farm: $_"
    exit 2
}