vuln.management
Act nowKnown exploited

Advisory · CVE-2026-55040

Attackers are exploiting a critical SharePoint authentication bypass

A critical JWT authentication weakness can let an unauthenticated network attacker bypass SharePoint security controls and access protected data.

Advisory published August 18, 2026Independent summary
Vendor
Microsoft
Product
SharePoint Server
Identifier / CWE
CVE-2026-55040
CWE-1390
Action timing
Aug 21, 2026
ELI5

Explain it like I’m five

SharePoint checks a digital entry pass incorrectly. An attacker can create a pass that looks acceptable and enter protected areas without a real account password.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted token

    An unauthenticated attacker sends a specially constructed JWT to SharePoint.

  2. 02Weak validation

    The server does not enforce the intended authentication property correctly.

  3. 03Security bypass

    SharePoint accepts an unauthorized request as trusted.

  4. 04Content exposed

    Protected information may be read or modified through the compromised trust path.

What happened

CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog on August 18, 2026. Microsoft rates the SharePoint weakness critical at CVSS 9.1. The vulnerability allows an unauthenticated attacker to bypass a security feature over the network by abusing JWT authentication handling.

SharePoint commonly stores operational documents, internal communications, identity-connected workflows, and sensitive business data. An authentication bypass can therefore become both a direct data incident and a starting point for wider access.

What to do

  1. Inventory on-premises SharePoint Server farms, including disaster-recovery and test systems that share production identities or data.
  2. Use the Microsoft Security Response Center product table to identify affected builds and apply the required updates.
  3. Restrict internet and untrusted-network access while remediation is in progress.
  4. Review authentication, web, audit, identity-provider, and endpoint telemetry for unusual tokens, access without expected sign-in events, or unexpected content changes.
  5. Investigate newly created accounts, elevated permissions, web-shell indicators, scheduled tasks, and outbound connections.
  6. Revoke sessions and rotate affected service credentials, signing material, or secrets if compromise cannot be excluded.
  7. Verify the installed build across every server in the farm rather than relying only on the farm configuration database.

Management note

Known exploitation plus authentication bypass means a successful patch does not answer whether the environment was already accessed. Pair the update with identity and content-access review, especially for internet-facing farms.