CVE-2026-55040 PoC Released for SharePoint Authentication Bypass

TL;DR

Rapid7 has published a technical analysis and a working proof-of-concept for CVE-2026-55040. The flaw is a critical SharePoint authentication bypass that lets a remote, unauthenticated attacker forge JWT tokens. Microsoft patched it in July 2026, and now full exploit details are public.

Why it matters

SharePoint stores much of the corporate world’s sensitive data. So an authentication bypass here is serious. This SharePoint authentication bypass lets an attacker act as any site user, including an administrator.

The bug carries a CVSS score of 9.1, rated critical. It needs no credentials, no prior access, and no user interaction. Moreover, Rapid7 chained it with a separate remote code execution flaw to reach unauthenticated RCE.

Public disclosure changes the risk

Until now, technical details sat under a 30-day embargo. Today Rapid7 lifted that embargo. The company published both the full analysis and a public proof-of-concept exploit on GitHub. As a result, the barrier to exploitation has dropped sharply.

How the attack works

The vulnerability lives in SharePoint’s JWT token validation pipeline. Rapid7 traced it to a chain of four separate weaknesses. Together, they let an attacker forge a valid token.

First, the outer token accepts the alg: none header, so no signature is required. Next, the forged actor token points its x5t header at SharePoint’s own signing certificate thumbprint. That certificate is exposed through an unauthenticated metadata endpoint.

Then the issuer check accepts the certificate because it is not in the specific trusted list being searched. Finally, a signature check requires only a non-empty string, never a valid one. The full Rapid7 technical analysis of CVE-2026-55040 walks through each step.

What the attacker gains

After validation passes, SharePoint trusts the attacker-chosen identity. The attacker sets a target user through a Windows SID or a User Principal Name. A UPN often looks like an email address. SIDs, meanwhile, can come from enumeration or other exposed systems.

Rapid7’s PoC shows the full flow. First, it enumerates users by iterating relative IDs over SMB. Then it locates the site administrator account. Finally, it forges a token and logs in as that admin. The script also demonstrates identifying as a local service account.

Where the flaw came from

Rapid7 Senior Principal Security Researcher Stephen Fewer found the bug. He demonstrated the chain at Pwn2Own Berlin. According to Rapid7, the research used AI agents across dozens of sessions to map the attack surface. The authentication bypass was the first link in a two-part exploit chain.

Affected versions

The flaw affects SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. Rapid7’s analysis used Subscription Edition build 16.0.19725.20210. On-premises farms carry the risk, so internet-facing servers deserve priority.

Exploitation status

A public proof-of-concept now exists, confirmed by Rapid7’s own release. However, no in-the-wild exploitation of CVE-2026-55040 has been confirmed at this time.

Patch and mitigation steps

Apply the July 2026 SharePoint security updates without delay. The relevant updates include KB5002882, KB5002883, and KB5002891. Then run the SharePoint configuration process on every farm server.

After patching, verify the resulting build numbers across the farm. Patching this SharePoint authentication bypass also breaks Rapid7’s demonstrated RCE chain. Microsoft fixed the paired RCE flaw in the August 2026 cycle.

Watch for follow-on activity

The flaw does not yet appear in CISA’s Known Exploited Vulnerabilities catalog. Still, public exploit code tends to draw fast attention. Therefore, treat this as urgent, especially on internet-facing farms. Monitor SharePoint logs for unusual token requests and unexpected admin actions. Prompt patching remains the clearest defense.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.