SharePoint's quiet 9.1: an unauthenticated auth-bypass that unlocks a still-unpatched RCE (CVE-2026-55040)

Buried in Microsoft's record July 2026 Patch Tuesday - roughly 570 CVEs in a single release - is a SharePoint bug that looks quiet on every dashboard and is anything but. It carries no KEV entry, no public proof-of-concept, and a low EPSS score, the trio that normally files a bug under do it next cycle. That read would be a mistake. The flaw is a security-feature bypass in SharePoint's token-authentication pipeline (CWE-1390, weak authentication): the control that ties a request to a validated identity can be defeated, so an anonymous attacker on the network can present a forged JSON Web Token the server trusts and become a chosen user. It was reported by Rapid7's Stephen Fewer as a Pwn2Own Berlin entry, and its real danger is architectural - it is the key that unlocks a separate, still-unpatched SharePoint RCE.

What the flaw actually is

On-prem SharePoint authenticates requests with signed JSON Web Tokens (JWTs). Rapid7 - who found the bug - describes "several issues in the JWT token validation pipeline" that let a remote, unauthenticated attacker present a token the server accepts and thereby assume the identity of any SharePoint site user, up to a farm administrator. That is precisely what **CWE-1390, weak authentication, names: the defeated "security feature" is the token check that should bind a request to a real, authorized principal. The one precondition is that the attacker must already know a valid target identity - an Active Directory SID or a User Principal Name** (the email-style login) - and Rapid7's proof-of-concept solves that operationally by enumerating SIDs to discover real users first, then forging a token to impersonate one.

Why "no public exploit" isn't "low risk"

As of July 21, 2026 the quiet signals are real and we should state them plainly: the bug is not in CISA's KEV catalog, there is no public PoC or Nuclei template (we checked GitHub code search and the ProjectDiscovery templates), and EPSS sits near 0.7%. But none of that means the bug is hard to weaponize. A finished, reliable Pwn2Own-grade exploit already exists - Rapid7 built it and agreed to Microsoft's standard ~30-day hold on technical details, so a public write-up and PoC are expected around mid-August 2026, most likely alongside Microsoft patching the chained RCE. "No GitHub PoC today" is an embargo artifact, not a difficulty rating. Microsoft's own exploitability index rates the flaw "Exploitation More Likely."

The exploitation chain

The reason a "bypass" earns a 9.1 is what it connects to. On its own the flaw buys identity impersonation - powerful, but not server takeover. Chained with a second bug, it becomes something worse. Rapid7 is explicit that the JWT bypass, wired to a separate remote-code-execution vulnerability, yields unauthenticated RCE - and that the RCE half was still unpatched at disclosure, expected in the August 2026 cycle. That is the 2025 ToolShell pattern exactly: an auth/bypass primitive removes the login requirement guarding an otherwise authenticated-only deserialization RCE. The crucial defender's detail is the bright side of the same fact - patching this bug alone severs the chain, before the RCE is even public. The diagram traces the path and marks where to break it.

Am I affected?

This is an on-premises bug. SharePoint Online (Microsoft 365) is not affected. If you run SharePoint Server 2016, 2019, or Subscription Edition, you're in scope until you're on the July 2026 build. Confirm the farm build with (Get-SPFarm).BuildVersion and cross-check Get-SPProduct -Local - a common trap is a Cumulative Update that's installed but never finished its config-database upgrade because PSConfig wasn't run, leaving the farm reporting an old, still-vulnerable build.

The timeline - and the clock that hasn't struck yet

The flaw sits inside a genuinely active SharePoint moment. Its siblings CVE-2026-56164 and CVE-2026-58644 are already exploited and on CISA's KEV list; this one is not. The dates that matter most are still ahead - the embargo lift and the second patch.

Detection & hunting

There is no CVE-specific signature and there can't be one yet - the technical detail is embargoed, and the bug is a token forgery, not a noisy request pattern. So you hunt the behaviour an auth bypass enables, using the well-documented ToolShell playbook as the template. The single highest-value signal is success where there should be failure: requests to authenticated-only SharePoint endpoints (/_api/, /_vti_bin/, admin surfaces) that return 200/302 with no matching successful authentication in the ULS logs - especially actions attributed to privileged accounts from unfamiliar IPs. Make sure IIS logging captures the Referer and User-Agent fields, or the classic bypass tells are invisible.

title: SharePoint ToolPane.aspx Access with Spoofed SignOut.aspx Referrer
status: experimental
description: ToolShell-pattern auth bypass reaching an admin-only endpoint without auth. Adapted as a generic SharePoint SFB behaviour detection for CVE-2026-55040 (no 55040 signature exists).
logsource:
  category: webserver
  product: iis
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/_layouts/15/ToolPane.aspx'
      - '/_layouts/16/ToolPane.aspx'
  selection_referrer:
    cs(Referer)|contains: '/_layouts/SignOut.aspx'
  condition: selection_method and selection_uri and selection_referrer
fields: [c-ip, cs-uri-query, cs(User-Agent), sc-status]
level: high

title: Suspicious ASPX File Creation in SharePoint LAYOUTS Directory
status: experimental
description: Web-shell drop (spinstall0.aspx etc.) under LAYOUTS - strong signal of any SharePoint auth/RCE compromise, including a chain from CVE-2026-55040.
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
  selection_ext:
    TargetFilename|endswith: '.aspx'
  selection_proc:
    Image|endswith: ['\w3wp.exe', '\cmd.exe', '\powershell.exe']
  condition: selection_path and selection_ext and selection_proc
fields: [Image, TargetFilename, User]
falsepositives:
  - SharePoint CU install writes .aspx to LAYOUTS via msiexec/OWSTIMER - scope Image to w3wp.exe or exclude maintenance windows
level: high

• Correlate IIS success against ULS auth: 200/302 on /_api/, /_vti_bin/, or admin endpoints with no matching successful sign-in is the closest thing to a bypass tell.
• Hunt web shells: new .aspx files under the LAYOUTS directory or web-app roots, and suspicious w3wp.exe child processes spawning cmd.exe/powershell.exe with -EncodedCommand.
• Assume-breach on keys: any sign of ASP.NET machine-key theft means forged __VIEWSTATE tokens are possible - rotate keys after hunting.
• Patch state, not exploit: in Microsoft Defender, DeviceTvmSoftwareVulnerabilities | where CveId == "CVE-2026-55040" lists hosts still missing the fix.

What to do now

1. Inventory every on-prem SharePoint farm and read its build - internet-facing ones first.
2. Patch to the July 14, 2026 update for your SKU and run PSConfig - the fix isn't active until the configuration wizard completes. This also breaks the RCE chain before its second half is public.
3. Harden while you patch: enable AMSI Full-mode body scanning, block external access to Central Administration, and keep farms off the raw internet.
4. Pre-stage detections for the mid-August details drop - deploy the ToolShell-pattern hunts now rather than waiting for a public PoC.
5. Plan the 2016/2019 migration to Subscription Edition - those SKUs are now out of extended support and may not get the August RCE fix.

FAQ

Sources

• Microsoft MSRC - CVE-2026-55040 advisory
• NVD - CVE-2026-55040
• Rapid7 - CVE-2026-55040: SharePoint JWT token authentication bypass (fixed)
• Rapid7 - Patch Tuesday, July 2026 (exploitability index)
• Help Net Security - Microsoft Patch Tuesday, July 2026 (SharePoint)
• BleepingComputer - Microsoft July 2026 Patch Tuesday fixes 570 flaws, 3 zero-days
• Tenable - Microsoft's July 2026 Patch Tuesday
• CISA - Known Exploited Vulnerabilities catalog
• Microsoft - KB5002882 (SharePoint Subscription Edition, July 2026)
• Microsoft - Configure AMSI integration for SharePoint Server
• Anomali - Detecting the ToolShell SharePoint exploit
• Microsoft Security Blog - Disrupting active exploitation of on-prem SharePoint (ToolShell, 2025)