Overview of CVE-2026-55040

A critical security vulnerability, identified as CVE-2026-55040, has recently emerged as a significant threat to organizations relying on on-premises Microsoft SharePoint instances. This vulnerability is an authentication bypass flaw in SharePoint’s JSON Web Token (JWT) validation pipeline, allowing remote, unauthenticated attackers to impersonate any user on the system—including site administrators—without ever providing a password.

The severity of this flaw is reflected in its CVSS score of 9.1 (Critical). Most alarmingly, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, confirming that threat actors are actively leveraging it in real-world attacks. Following the release of technical details and proof-of-concept (PoC) code by security researchers, exploitation attempts have spiked, making immediate remediation a top priority for IT security teams.

Technical Details and Affected Systems

The vulnerability resides within the SPJsonWebSecurityTokenHandlerV2 class, which SharePoint use for service-to-service (S2S) authentication. Researchers discovered a chain of four cascading weaknesses in the token validation logic:

• Disabled Signature Requirements: The system was found to accept tokens with the “alg: none” header, bypass cryptographic verification entirely.
• Unverified Certificate Thumbprints: Attackers can force the system to use a chosen certificate by providing a matching thumbprint in the token header, which the application trusts without verifying the signature against the actual certificate.
• Failed Issuer Validation: The validation process fails to reject issuers that are not registered or trusted within the SharePoint environment.
• Trivial Signature Checks: In some instances, the system only verifies that the signature field is non-empty, allowing any placeholder text to pass the check.

By chaining these flaws, an attacker who can determine or guess a target user’s Security Identifier (SID) or User Principal Name (UPN) can forge a JWT that grants them full access as that user. If an administrator account is impersonated, the attacker gains total control over the SharePoint farm, its data, and its configuration.

The following on-premises versions of SharePoint are affected:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Impact and Real-World Risk

The impact of a successful exploit is devastating. Beyond unauthorized access to sensitive documents, internal communications, and proprietary business data, CVE-2026-55040 can serve as a beachhead for further attacks. Security analysts have demonstrated that this authentication bypass can be chained with other vulnerabilities (such as CVE-2026-63520) to achieve full, unauthenticated Remote Code Execution (RCE) on the server. This would allow an attacker to move laterally through the corporate network or deploy ransomware.

Because many organizations expose SharePoint servers to the internet to facilitate remote work and collaboration, these systems are primary targets for automated scanning and mass exploitation by sophisticated threat actors and state-sponsored groups.

Mitigation and Patching Requirements

Microsoft released official security updates to address this vulnerability. Organizations must act quickly to apply the following patches based on their SharePoint version:

• SharePoint Server Subscription Edition: Apply KB5002882
• SharePoint Server 2019: Apply KB5002883
• SharePoint Enterprise Server 2016: Apply KB5002891

Crucial Note: Simply installing the update package is often insufficient. Administrators must run the SharePoint Products Configuration Wizard on every server in the farm after the patches are installed to ensure the updated code is properly registered and the vulnerability is fully mitigated.

Additional defensive measures include:

• Restricting direct internet access to SharePoint virtual directories.
• Implementing a Layer 7 reverse proxy or Web Application Firewall (WAF) to inspect traffic for malformed tokens or suspicious headers.
• Verifying the build numbers of all SharePoint servers manually to confirm the successful application of security updates.

With threat actors already weaponizing this flaw, the window for patching is closing. Organizations should treat CVE-2026-55040 as an emergency update and verify its successful deployment across their entire SharePoint infrastructure immediately.