In the July 2026 Patch Tuesday, Microsoft fixed a critical authentication bypass flaw in SharePoint Server. A month later, with a public exploit available, it became one of the most attacked vulnerabilities of the half-year.

What the flaw allows

CVE-2026-55040 was rated CVSS 9.1 and stems from a chain of four weaknesses in JWT token validation. A remote, unauthenticated attacker can forge a valid token and assume the identity of any user on the site, including an administrator. The only prerequisite is knowing in advance which user they want to impersonate.

According to Microsoft's advisory, successful exploitation allows file disclosure and data modification across the entire SharePoint farm. Chained with CVE-2026-63520, the flaw opens the way to remote code execution with no authentication at all.

Why it became urgent

On 11 August 2026, Rapid7 published the technical analysis and a proof-of-concept script. Attacks against unpatched servers began within hours. On 18 August, CISA added the flaw to the KEV catalog, which in practice means exploitation confirmed in real environments.

SharePoint Enterprise Server 2016, SharePoint Server 2019 and Subscription Edition are affected.

What to do now

• Apply the July 2026 cumulative package to every SharePoint server.

• Survey which instances are reachable from the internet and pull off the edge anything that does not need to be exposed.

• Rotate machine keys and service credentials after patching: the patch closes the door, but it does not invalidate tokens that have already been forged.

• Hunt for signs of impersonation: authentications with no matching logon event, administrative access outside business hours, bulk collection from document libraries.

• Review privileged accounts created or altered since July.