CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
Researchers at Rapid7 have revealed a critical authentication bypass flaw in Microsoft SharePoint, tracked as CVE-2026-55040. This vulnerability enables unauthenticated attackers to impersonate users or administrators on vulnerable SharePoint servers by exploiting weaknesses in the JWT token validation process. The flaw is part of an exploit chain that leads to remote code execution, with the RCE component expected to be patched in August 2026. A proof-of-concept script demonstrates how attackers can enumerate user SIDs or UPNs and bypass authentication entirely. Microsoft has acknowledged the issue and released a fix for the authentication bypass in its July updates.
Overview
Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the first vulnerability in this chain, the authentication bypass vulnerability CVE-2026-55040. The RCE component of the exploit chain is expected to be patched by Microsoft in the next update cycle for August 2026. The exploit chain was developed as an entry for the recent Pwn2Own Berlin hacking competition – part of Rapid7 Labs' continued effort to raise the bar in Vulnerability Intelligence and our commitment to the preemptive protection of our customers through original vulnerability research.…