CVE-2026-55040

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-55040 9.1

Microsoft · SharePoint · Added 2026-08-18 · Published 2026-07-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Weak Authentication Vulnerability

VendorMicrosoft

ProductSharePoint

Date added2026-08-18

Due date2026-08-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-1390

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Descriptions

KEV: Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

NVD: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 17:46 UTC

Wall time0.4s

Searches2

Component defaultunknown

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
https://github.com/l0ggg/CVE-2026-55040
https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/
https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
https://windowsforum.com/security-alerts.84/cve-2026-55040-patch-critical-sharepoint-server-auth-bypass.438738/
https://cvereports.com/reports/CVE-2026-55040
https://blog.viettelcybersecurity.com/sharepoint-cve-2026-55040/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'SharePoint Server JWT token validation (/_layouts/15/metadata/json/1 endpoint and token verification)' matches or contains product name 'SharePoint' — no specific component identified

Hunting hypothesis agent

Hunt SharePoint IIS logs for /_layouts/15/metadata/json/1 requests, then check Authorization headers for JWT with alg:none and actortoken containing nii:microsoft.sharepoint; stock IIS logs miss JWT payloads, enable advanced logging or WAF.

Research details

ComponentSharePoint Server JWT token validation (/_layouts/15/metadata/json/1 endpoint and token verification)

PreconditionsNetwork access to a SharePoint Server instance (Subscription Edition, 2016, or 2019) over HTTPS; no authentication required. The attacker fetches the issuer and signing key from /_layouts/15/metadata/json/1, constructs a forged JWT with alg:none, embeds an unsigned actor token containing nii:microsoft.sharepoint and the target's issuer value, and sets the nameid claim to any valid username (default: 'c#.w|NT AUTHORITY\\LOCAL SERVICE'). The forged token is then used in the Authorization header to access SharePoint resources as the impersonated user. agent

DeliveryNetwork (HTTPS requests to SharePoint metadata and content endpoints)

Public PoCyes

PoC URLs https://github.com/l0ggg/CVE-2026-55040 Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040

Exploit notesPublic PoC available (gettoken.py) — Python script that fetches SharePoint metadata from /_layouts/15/metadata/json/1, extracts the issuer and signing key, constructs a forged outer JWT with alg:none and an embedded unsigned actor token with claim nii:microsoft.sharepoint, sets the nameid to a target username, and outputs a valid Authorization header. The exploit chains metadata disclosure with JWT algorithm confusion. The actortoken is a nested unsigned JWT with header {typ:JWT, alg:RS256, x5t:<sha1-of-cert>}, and the outer token uses the magic GUID 00000003-0000-0ff1-ce00-000000000000 as aud/iss. CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Active exploitation observed within hours of Rapid7 PoC publication on August 11 2026.

SummaryMicrosoft SharePoint Server (Subscription Edition, 2016, 2019) weak authentication vulnerability (CWE-1390) allowing unauthenticated JWT token forgery to impersonate any site user including administrators. The exploit queries the SharePoint metadata endpoint (/_layouts/15/metadata/json/1) to obtain the issuer and signing key, then constructs a forged JWT with algorithm:none containing an unsigned actor token with the claim nii:microsoft.sharepoint. The resulting token grants full access to SharePoint site content and admin functions. CVSS 9.1; patched in July 2026 Patch Tuesday. Actively exploited.

Tia coverage

First reported2026-07-15

First exploit report2026-07-16

Exploit report → KEV33 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed microsoft-july-2026-patch-tuesday-record-622-cves-two-exploited microsoft-s-august-2026-patch-tuesday-addresses-398-cves-cve-202 microsoft-sharepoint-exploitation-fourth-kev-entry-tenable-confi warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.