Key Takeaways<\/p>\n
- \n
- Patch authentication first.<\/strong> CVE-2026-55040 is the entry point. Without a valid session, the RCE chain described by Rapid7 breaks.<\/li>\n
- Identity suffices.<\/strong> The target user\u2019s SID or UPN suffices as a prerequisite for identity takeover.<\/li>\n
- Prioritize on-prem.<\/strong> Internet\u2011exposed SharePoint servers are the urgent inventory, not just the CVE list.<\/li>\n
- Second zero\u2011day under scrutiny.<\/strong> CVE-2026-56164 (SharePoint EoP) has already been exploited according to Microsoft. Check AMSI mitigations.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>The weakest supplier opens the critical facility<\/a> \/<\/span> A signed driver blinds endpoint protection<\/a><\/p>\n
What CVE-2026-55040 Breaks<\/h2>\n
What is the SharePoint JWT Bypass?<\/strong> CVE-2026-55040 is a vulnerability in the JWT token validation of Microsoft SharePoint. A remote, unauthenticated attacker can bypass authentication and perform actions as a site user or administrator, provided they know the target identity.<\/p>\n
The flaw was discovered by Stephen Fewer of Rapid7 Labs as part of a zero\u2011day research project. Coordination with Microsoft began on May 18, 2026. On July 14, 2026, public disclosure was released along with the July patch.<\/p>\n
\n9.1<\/div>\nCVSS v3.1 for CVE-2026-55040 (Critical)<\/p>\n
Source: Rapid7 \/ FIRST Calculator<\/p>\n<\/div>\n
The prerequisite is precise: The attacker must know the target, such as via an Active Directory SID or UPN (typically email\u2011like). Then they can assume the identity. Rapid7 describes SID enumeration plus identity takeover up to the site administrator in the PoC representation.<\/p>\n
\nDefinition \u00b7 JSON Web Token (JWT) Authentication Bypass<\/p>\n
An attacker bypasses token verification and acts as a known SharePoint user without knowing their password.<\/p>\n<\/div>\n
Why the Auth Bypass Stops the RCE Chain<\/h2>\n
Rapid7 linked the bypass to an unauthenticated remote code execution (RCE) flaw, which Microsoft had scheduled for the August patch cycle. The July fix for CVE-2026-55040 already breaks this chain. Authentication bypasses are far from minor problems-they fully expose the authenticated attack surface.<\/p>\n
At the same time, the July patch Tuesday addresses CVE-2026-56164, a SharePoint elevation\u2011of\u2011privilege vulnerability that Microsoft reports is actively exploited (CVSS 5.3, Moderate). Affected: SharePoint Server 2016, 2019 and the Subscription Edition. Microsoft points to AMSI integration as an additional detection mechanism for malicious POST requests. This does not replace the patch but complements it.<\/p>\n
Priority for DACH Admins<\/h2>\n
Start by inventorying: Which SharePoint servers are running on\u2011premises and reachable from the Internet? Every such instance qualifies as a hotfix. Then verify the patch level against the July updates. Record the build status. Keep a rollback plan on hand-but don\u2019t postpone the patches.<\/p>\n
Next, hunt for identity clues: unusual site\u2011admin activity, new web parts, suspicious file uploads, token and authentication anomalies in the logs. Those who only chase CVEs and ignore exposure are wasting time.<\/p>\n
\nON-PREM-SHAREPOINT NOW<\/p>\n
- \n
- ✓<\/span>Apply the July 2026 updates for SharePoint Server and verify the build status<\/li>\n
- ✓<\/span>Inventory internet\u2011exposed SharePoint instances and kill the exposure<\/li>\n
- ✓<\/span>Check AMSI integration for SharePoint (Microsoft mitigation for related EoP paths)<\/li>\n
- ✓<\/span>Audit admin and site accounts for unusual logins and token patterns<\/li>\n
- ✓<\/span>Track auth\u2011bypass and RCE chains separately: schedule the August patch for the RCE component<\/li>\n<\/ul>\n<\/div>\n
What the Board Set Must Include<\/h2>\n
On-Prem-SharePoint remains an attack surface as long as authentication paths are weak and instances are exposed. CVE-2026-55040 shows: collaboration platforms are management layers. Who patches them and removes them from the internet breaks chains. Who waits buys the August RCE share at a higher price.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nIs CVE-2026-55040 remotely exploitable?<\/strong><\/summary>\n
Yes. Rapid7 describes a remote, unauthenticated attack path. Prerequisite is knowledge of the target identity (SID or UPN).<\/p>\n<\/details>\n
\nIs the July patch sufficient against the full RCE chain?<\/strong><\/summary>\n
He breaks the chain described by Rapid7 at the Auth-Bypass. The separate RCE component is slated to follow in the August cycle. Nevertheless, patch immediately.<\/p>\n<\/details>\n
\nIs SharePoint Online affected?<\/strong><\/summary>\n
The disclosure targets SharePoint Server and the JWT validation pipeline of the affected server products. The MSRC entry for the respective build provides the exact patch scope.<\/p>\n<\/details>\n
\nWhat is the difference to CVE-2026-56164?<\/strong><\/summary>\n
56164 is an EoP with confirmed exploitation in the wild. 55040 is a JWT authentication bypass with CVSS 9.1 and chaining potential to RCE.<\/p>\n<\/details>\n
\nWhich mitigation counts in addition to the patch?<\/strong><\/summary>\n
Reduce internet exposure, activate AMSI for SharePoint, monitor admin accounts, and alert on unusual site operations.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/kritis-lieferkette-zulieferer-resilienz-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>Weakest Supplier Opens Critical Facility<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/cover-hero-8-250x143.jpg\")
<\/span>Editor’s Pick<\/span>A Signed Driver Makes Endpoint Protection Blind<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-wenn-gpus-den-saas-etat-auffressen-24878004.jpg\")
<\/span>cloudmagazin<\/span>When GPUs Devour the SaaS Budget<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-wann-sich-deutsches-ki-modell-rechnet-45689807-250x143.jpg\")
<\/span>MyBusinessFuture<\/span>When a German AI Model Truly Pays Off<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"CVE-2026-55040: Unauthenticated SharePoint JWT bypass (CVSS 9.1). Rapid7 chain, July patch, and on-prem admin checklist.","protected":false},"author":10,"featured_media":22103,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"SharePoint JWT bypass CVE-2026-55040","_yoast_wpseo_title":"SharePoint JWT Bypass Exposes On-Premises Sites","_yoast_wpseo_metadesc":"CVE-2026-55040: Unauthenticated SharePoint JWT bypass (CVSS 9.1). Rapid7 exploit chain, July patch, and on-prem admin checklist.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-22112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":22102,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22112"}],"version-history":[{"count":1,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22112\/revisions"}],"predecessor-version":[{"id":22124,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22112\/revisions\/22124"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22103"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - ✓<\/span>Inventory internet\u2011exposed SharePoint instances and kill the exposure<\/li>\n
- Identity suffices.<\/strong> The target user\u2019s SID or UPN suffices as a prerequisite for identity takeover.<\/li>\n