CVE-2026-55040: how a SharePoint authentication bypass (CVSS 9.1) lets attackers take over an admin account without a password?
BLUF
Microsoft SharePoint has a critical flaw CVE-2026-55040 (CVSS 9.1): weak authentication (CWE-1390) in JWT token validation lets a remote attacker forge a token and impersonate an administrator with no credentials at all. Rapid7 published a working PoC on 11 Aug 2026, and in-the-wild exploitation began within hours — CISA added the flaw to the KEV catalog on 18 Aug 2026 with a patching deadline of 21 Aug 2026. It is the fifth SharePoint vulnerability exploited this year. Recommendation: urgently verify your SharePoint version, deploy the Microsoft patch, and audit logs for unusual administrative authentications.
Key facts
- CVE-2026-55040 is a weak-authentication flaw (CWE-1390) in the JWT token validation mechanism of Microsoft SharePoint that lets an attacker forge a token and impersonate an administrator without credentials (CVSS 3.1: 9.1 CRITICAL). [1][3]
- Rapid7 published a working proof-of-concept on 11 Aug 2026 — the PoC first enumerates users (iterating relative IDs over SMB), locates a site administrator account, then forges a JWT token to gain full privileges. [3][4]
- In-the-wild exploitation began within hours of the PoC release — Microsoft confirmed the flaw enables impersonation, and Defused honeypots logged attackers using the Rapid7 PoC. [4]
- CISA added the flaw to the Known Exploited Vulnerabilities catalog on 18 Aug 2026, confirming active exploitation; US federal agencies must patch by 21 Aug 2026 (BOD 26-04). [1][2]
- This is the fifth SharePoint vulnerability exploited this year, and more than 8,500 on-premises SharePoint servers remain internet-exposed — a large attack surface for initial access. [5][6]
Decision table
| Area | What we know | What it means for B2B/manufacturing | Recommended action (30/90 days) |
|---|---|---|---|
| On-premises SharePoint servers | Auth bypass via JWT forgery, no credentials | Internet-exposed SharePoint is a direct path to admin takeover and initial access | Deploy the Microsoft patch urgently; restrict SharePoint exposure to internal network / behind a WAF |
| Identities and permissions | Admin impersonation without a password | Any permission change or data in SharePoint may be unauthorized | Review auth logs and admin permission changes for 11–18.08.2026; enforce MFA on admin accounts |
| Vulnerability management | Public PoC, real-time exploitation | Slow patching means incident and reporting obligations | Vulnerability register with patch date; patch management process with critical SLA |
| NIS2/KSC compliance | Incident illustrates NIS2 Art. 21 obligations (vulnerability management, supply security) | An unpatched system may count as a lack of due care | Documented patching process + incident reporting and risk-register prep |
Marcin Białczyk's perspective
From an operational standpoint, CVE-2026-55040 is a textbook example of how a fast public PoC collapses the window between publication and real exploitation. When a flaw hits authentication and lets you impersonate an administrator without a password, we are no longer talking about "theoretical risk" — it is a vector that genuinely leads to environment takeover. In manufacturing and critical infrastructure, it is especially dangerous because SharePoint often holds technical documentation and acts as a gateway into internal systems.
From my deployments, three things matter most: (1) knowing which SharePoint instances are actually internet-exposed and at what version, (2) having a process that can push a critical patch in days rather than a quarter, and (3) always auditing administrative authentication logs after such a flaw — admin impersonation leaves a trace, but only if you know where to look. A KEV entry is a signal to act, not the end of the story.
[[TO ADD — production client deployment case study when such a case exists; no fictional scenarios.]]
FAQ
Does this affect only SharePoint Online, or on-premises too?
The flaw sits in the JWT authentication mechanism of vulnerable SharePoint versions, including on-premises installations — more than 8,500 such servers remain internet-exposed. Check your exact version against the Microsoft advisory.
Do I need a password or user credentials to exploit it?
No — the core of the flaw is the ability to forge a JWT token and impersonate an administrator with no credentials at all. So password policy alone does not protect against this vector; the patch and reduced exposure are what matter.
How fast should I react?
CISA requires US federal agencies to patch by 21 Aug 2026. For commercial organizations we recommend urgently deploying the Microsoft patch, and immediately for internet-exposed servers.
Is there anything to check beyond deploying the patch?
Yes — review authentication logs and administrative privilege changes since 11 Aug 2026 (PoC publication date) for unusual events. Enforce MFA on admin accounts and restrict SharePoint exposure.
CTA
- CHORS.NET services — how we work with clients
- NIS2/KSC — obligations and support
- Our AI policy and approach to cybersecurity
- How CHORS.NET works — methodology
Boundaries and assumptions
- We are not a 24/7 SOC and do not guarantee detection of every incident.
- We do not certify NIS2/KSC compliance and do not issue independent legal opinions.
- Results reflect the state at the time of writing (18 Aug 2026); technical details may change with vendor updates.
- CHORS works with law firms on legal interpretation.
- Informational and technical material; not legal advice. Implement changes per your organization's policy and after testing in a non-production environment.