SharePoint Server JWT token authentication bypass
Critical authentication bypass in Microsoft SharePoint Server's JWT validation pipeline. Half of a pre-auth RCE chain disclosed by Rapid7; patched in the July 2026 cumulative update.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server (on-prem; see MSRC advisory for affected builds)
- CVSS
- 9.1
- EPSS (exploit probability)
- 69.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-55040 being exploited?
Yes. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 69.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-55040 is a critical (CVSS 9.1) authentication bypass in Microsoft SharePoint Server, caused by validation failures in the JWT token pipeline that let an unauthenticated attacker assume a user identity over the network. Discovered by Rapid7 Labs and disclosed to Microsoft ahead of coordinated release.
Microsoft shipped the fix in the July 2026 Patch Tuesday release on 2026-07-14. Rapid7 is holding full technical detail under a roughly 30-day embargo, expiring in mid-August.
Half of a chain. Rapid7’s research chained CVE-2026-55040 with a separate SharePoint RCE vulnerability to reach unauthenticated remote code execution end-to-end. The RCE half has been disclosed to Microsoft but is not yet patched — expected in the August 2026 update cycle.
Exploitation status. No public PoC. No confirmed in-the-wild exploitation of CVE-2026-55040 at time of publication. Separately, CVE-2026-56164 — a different SharePoint bug in the same patch cycle — is actively exploited and was added to CISA KEV on 2026-07-14; both should be patched together.
See the write-up: SharePoint JWT bypass fixed; RCE half of chain still open.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | |
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | |
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 1.0% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 2.7% | |
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 43.4% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.1% |
