SharePoint CVE-2026-55040: Forging admin credentials with no password
CVE-2026-55040 lets an unauthenticated attacker forge a valid JSON Web Token and impersonate any user on an on-premises SharePoint server, including site administrators, with no credentials, no prior access, and no user interaction. Microsoft patched it on July 14. Rapid7 published a proof-of-concept on August 11 after a 30-day embargo. Exploitation began within hours of that publication. If your on-premises SharePoint is internet-facing and unpatched, you should treat this as an active incident risk right now.
How the attack works
SharePoint Server validates JSON Web Tokens to authenticate users and grant access to resources. CVE-2026-55040 chains four weaknesses in the JWT validation pipeline that together allow an attacker to construct a token SharePoint accepts as legitimate. The forged token can assert any identity on the system, including site administrators. No special tools are required beyond a working understanding of JWT structure and the documented flaws.
The impact is full administrative access to all SharePoint content without credentials. For organizations using on-premises SharePoint to manage sensitive documents, contracts, or internal communications, this is a complete authentication bypass with no compensating control short of taking the server offline or isolating it from the internet.
Timeline
July 14, 2026: Microsoft patches CVE-2026-55040 in Patch Tuesday. August 11, 2026: Rapid7 publishes technical analysis and proof-of-concept after the 30-day embargo. August 11-12, 2026: Exploitation begins within hours of PoC publication. August 18, 2026: CISA adds CVE-2026-55040 to the Known Exploited Vulnerabilities catalog with an FCEB mandatory remediation deadline of September 8, 2026. KEVIntel recorded 8 exploitation attempts on August 12 and 13 alone, out of 12 total since mid-July. Activity is accelerating.
What to do right now
Patch on-premises SharePoint Server immediately. This applies to Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online is not affected. If patching requires a downtime window you cannot schedule immediately, restrict internet access to the server at your perimeter until the patch is applied. Review SharePoint access logs for unusual authentication activity, particularly sessions that appeared without corresponding login events. Any unexplained administrative sessions since August 11 warrant investigation.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help triaging your on-premises SharePoint exposure or reviewing access logs for signs of compromise.