1. Executive summary
CVE-2026-55040 is a critical (CVSS 9.1) weak authentication vulnerability in Microsoft Office SharePoint that allows an unauthenticated, remote attacker to bypass security features over a network. The flaw exists in the JWT token validation pipeline, enabling an attacker to assume the identity of any known SharePoint user or administrator. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-08-18 following active exploitation in the wild and the public release of proof-of-concept (PoC) code. EMEA financial services running internet-facing SharePoint infrastructure are at immediate risk of unauthenticated data access and potential unauthenticated remote code execution (RCE) when chained with a separate, unpatched vulnerability.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Active exploitation of a CVSS 9.1 authentication bypass on critical SharePoint infrastructure with confirmed RCE chaining potential. | If an EMEA financial entity detects exploitation on a SharePoint server handling sensitive data, it likely meets the threshold for a major ICT-related incident report to the competent authority. |
| DORA Art. 24: digital operational resilience testing — general requirements | CISA KEV inclusion and public PoC code confirm a high-probability, automatable threat to internet-facing assets. | Entities must prioritise immediate vulnerability scanning and patching of SharePoint assets under their mandated resilience testing programmes. |
3. Technical analysis & attack chain
The vulnerability resides in the JWT token validation pipeline of Microsoft Office SharePoint. An unauthenticated, remote attacker can bypass authentication by exploiting weak validation logic, provided they know the identity of a target user in advance. Target identities can be enumerated via Active Directory (AD) Security IDs (SIDs) or User Principal Names (UPNs) (e.g., administrator@domain.local).
Confirmed attack chain
- Target enumeration: The attacker enumerates potential SharePoint users via SID or UPN.
- Authentication bypass: The attacker sends a crafted request to the vulnerable SharePoint server exploiting CVE-2026-55040 to bypass the JWT token validation pipeline.
- Identity assumption: The server accepts the forged context, allowing the attacker to perform operations as the targeted user (up to and including Site Administrator).
- Privilege escalation / RCE chaining: Rapid7 has confirmed that this authentication bypass can be chained with a separate, unpatched RCE vulnerability to achieve unauthenticated remote code execution on the SharePoint server.
Discrepancy note: The VERIFIED REFERENCE DATA classifies this vulnerability with a CVSS score of 9.1 (CRITICAL) and CWE-1390 (Weak Authentication). Rapid7's source text assesses the vulnerability at CVSS 3.1 5.3 (Medium). This advisory uses the authoritative 9.1 CRITICAL rating. Both assessments describe the same underlying JWT validation bypass; the discrepancy in score stems from Microsoft/CISA evaluating the chained RCE impact as critical, while Rapid7's base score reflects the authentication bypass in isolation.
Confidence caveat: The technical mechanism (JWT token validation pipeline) and the unauthenticated RCE chain are single-sourced, originating from Rapid7 Labs' research. Verify internal SharePoint configurations against this vector before enforcement.
4. Mitigation & containment
P1 — Within 24 hours
- Patch immediately: Apply the Microsoft July 2026 Patch Tuesday updates for Microsoft Office SharePoint to all server instances. This patches CVE-2026-55040 and breaks the known unauthenticated RCE exploit chain.
- Isolate internet-facing instances: If patching cannot be completed within 24 hours, temporarily restrict external access to SharePoint web applications at the firewall/WAF level (block TCP 443/80 to SharePoint front-end servers from untrusted networks) or disable the affected SharePoint application pools in IIS Manager.
P2 — Within 72 hours
- Hunt for exploitation: Review IIS and SharePoint ULS logs for anomalous authentication events. Look for successful access or administrative actions originating from untrusted IP ranges or lacking corresponding NTLM/Kerberos ticket issuance events in Active Directory.
- Audit UPN/SID exposure: Ensure Active Directory enumeration is not possible from untrusted network segments. Restrict LDAP query access to authenticated, authorised service accounts.
P3 — Within 7 days
- Validate RCE posture: While the secondary RCE vulnerability in the chain is expected to be patched in the August 2026 cycle, ensure SharePoint servers are hardened (least-privilege application pool identities, restricted PowerShell remoting, disabled web.config debug features) to limit impact if the chain is utilised.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Successful SharePoint authentication/authorization events without corresponding Active Directory Kerberos/NTLM ticket issuance. | IIS W3SVC logs, SharePoint ULS logs, Windows Security Event Logs (ID 4624). | High |
| Anomalous enumeration of AD SIDs or UPNs followed by access to SharePoint sites. | Domain Controller LDAP query logs, SharePoint ULS logs. | Medium |
Unexpected execution of child processes from the SharePoint application pool worker process (w3wp.exe). |
EDR telemetry, Windows Event Logs. | Medium |
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-55040 | 9.1 Critical | ⚠ KEV 2026-08-18 | 4% | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
7. Sources
- NVD, CVE-2026-55040 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-55040, 2026-08-17
- CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-55040, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040, 2026-08-18
- Rapid7, CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED), https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed, 2026-08-18
- The Hacker News, Attackers Exploit SharePoint Authentication Bypass After Public PoC Release, https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html, 2026-08-18
8. Adverse Trace position
CVE-2026-55040 presents a critical and immediate risk to EMEA financial services. The authoritative CVSS 9.1 rating, combined with CISA KEV inclusion and confirmed active exploitation following a public PoC, necessitates emergency patching. The ability to chain this authentication bypass with an unpatched RCE vulnerability elevates the threat from data access to full system compromise. Adverse Trace assesses the attribution of active exploitation as unconfirmed (no named threat actor with a MITRE profile is identified in the verified data), but the technical validity of the exploit chain is high. We will continue to monitor for the August 2026 patch cycle release addressing the RCE component and will update clients if IOCs or specific threat actor TTPs emerge.
Published via PulseTrace — Adverse Trace threat intelligence.