A SharePoint JWT validation bug let unauthenticated attackers become any user, including admins

Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), a defect in Microsoft SharePoint's JWT validation pipeline that let an unauthenticated, network-based attacker impersonate any SharePoint user, up to and including administrators. The attack needs only the target's identity, discoverable through Active Directory Security ID enumeration or a guessed user principal name in the familiar email-address format, and no credentials or MFA prompt at any step. Rapid7 found it as one half of a two-vulnerability chain: paired with a separate remote-code-execution flaw, the authentication bypass turns into full unauthenticated RCE, which is why patching CVE-2026-55040 alone breaks the chain. Rapid7 reported the issue to Microsoft on May 18, 2026; Microsoft fixed the authentication bypass in its July 2026 patch cycle, with the paired RCE component scheduled for August. Public technical details were withheld for 30 days at Microsoft's request before the July 14 disclosure. No in-the-wild exploitation has been confirmed.

Why it matters

This is a textbook token theft bug with the theft step removed entirely: rather than steal a session token, the attacker's forged JWT simply passes validation as if it were real, which means credential rotation, MFA, and password strength are all irrelevant to it. Fixing this class of bug means auditing the validation logic itself, not the credentials it's supposed to be checking.

If you run SharePoint on-premises or hybrid, confirm you applied the July patch specifically and don't wait for the August RCE fix to treat this as closed, since the authentication bypass is independently dangerous even without its RCE pair.

Source: Rapid7

Update, August 29, 2026: exploitation began after Rapid7 published a proof of concept in mid-August, with a spike of attempts on August 12 and 13 from eight IP addresses across five countries. See the follow-up and the CVE brief.