Key Takeaways<\/p>\n
- \n
- Patch authentication first.<\/strong> CVE-2026-55040 is the entry point. Without a valid session, the RCE chain described by Rapid7 breaks.<\/li>\n
- Identity is sufficient.<\/strong> The target user’s SID or UPN is enough as a prerequisite for impersonation.<\/li>\n
- Prioritize on-premises.<\/strong> Internet-exposed SharePoint servers are the urgent inventory, not just the CVE list.<\/li>\n
- Second zero\u2011day under scrutiny.<\/strong> CVE-2026-56164 (SharePoint EoP) has already been exploited according to Microsoft. Check AMSI mitigations.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>The weakest supplier opens the critical installation<\/a> \/<\/span> A signed driver makes endpoint protection blind<\/a><\/p>\n
What CVE-2026-55040 Breaks<\/h2>\n
What is the SharePoint JWT Bypass?<\/strong> CVE-2026-55040 is a vulnerability in Microsoft SharePoint\u2019s JWT token validation. An unauthenticated remote attacker can bypass authentication and act as a site user or administrator, provided they know the target identity.<\/p>\n
Stephen Fewer of Rapid7 Labs discovered the flaw as part of a zero\u2011day research project. Coordination with Microsoft began on May 18, 2026. On July 14, 2026, public disclosure was released along with the July patch.<\/p>\n
\n9,1<\/div>\nCVSS v3.1 for CVE-2026-55040 (Critical)<\/p>\n
Source: Rapid7 \/ FIRST-Rechner<\/p>\n<\/div>\n
The prerequisite is precise: the attacker must know the target-such as an Active Directory SID or UPN (typically resembling an email address). Afterwards, they can assume the identity. Rapid7 details SID enumeration plus identity takeover up to site administrator in the proof\u2011of\u2011concept illustration.<\/p>\n
\nDefinition \u00b7 JWT-Auth-Bypass<\/p>\n
An attacker bypasses token verification and impersonates a known SharePoint user without knowing their password.<\/p>\n<\/div>\n
Why the Auth Bypass Stops the RCE Chain<\/h2>\n
Rapid7 linked the bypass to a separate RCE vulnerability that enables unauthorized remote code execution. Microsoft had scheduled the RCE component for the August patch cycle. The July fix for CVE-2026-55040 already breaks this chain. Auth bypasses are therefore not minor issues-they fully expose the authenticated attack surface.<\/p>\n
At the same time, the July patch Tuesday addresses CVE-2026-56164, a SharePoint elevation-of-privilege vulnerability that Microsoft reports is actively exploited (CVSS 5.3, Moderate). Affected: SharePoint Server 2016, 2019, and Subscription Edition. Microsoft points to AMSI integration as an additional detection mechanism for malicious POST requests. This does not replace the patch but complements it.<\/p>\n
Priority for DACH Admins<\/h2>\n
First, inventory: Which SharePoint servers are on\u2011prem and reachable from the internet? Every such instance is a hotfix. Next, check the patch level against the July updates. Document the builds. Have a rollback plan ready, but don\u2019t delay patching.<\/p>\n
Next, identity traces: unusual site\u2011admin activity, new web parts, suspicious file uploads, token and auth anomalies in the logs. Those who only tick CVEs and ignore exposure waste time.<\/p>\n
\nOn-Prem-SharePoint now<\/p>\n
- \n
- ✓<\/span>Apply July-2026 Updates for SharePoint Server and verify the build standard<\/li>\n
- ✓<\/span>Inventory internet\u2011exposed SharePoint instances and kill exposure<\/li>\n
- ✓<\/span>Check AMSI integration for SharePoint (Microsoft mitigation for related EoP paths)<\/li>\n
- ✓<\/span>Audit admin and site accounts for unusual logins and token patterns<\/li>\n
- ✓<\/span>Track separate auth bypass and RCE chain: plan August patch for RCE component<\/li>\n<\/ul>\n<\/div>\n
What the Board Must Include<\/h2>\n
On-Prem SharePoint stays an attack surface while authentication paths remain weak and instances are exposed. CVE-2026-55040 demonstrates that collaboration platforms occupy the management layer. Patching them and disconnecting them from the Internet breaks the chain. Those who delay end up purchasing the August-RCE component at a higher cost.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nIs CVE-2026-55040 remotely exploitable?<\/strong><\/summary>\n
Yes. Rapid7 describes a remote, unauthenticated attack path. The prerequisite is knowledge of the target identity (SID or UPN).<\/p>\n<\/details>\n
\nDoes the July patch hold up against the full RCE chain?<\/strong><\/summary>\n
He breaks the chain described by Rapid7 at the Auth-Bypass. The separate RCE component is slated to follow in the August cycle. Nevertheless, patch immediately.<\/p>\n<\/details>\n
\nIs it about SharePoint Online?<\/strong><\/summary>\n
The disclosure targets SharePoint Server and the JWT validation pipeline of the affected server products. The Microsoft Security Response Center (MSRC) entry for the respective build provides the exact patch scope.<\/p>\n<\/details>\n
\nWhat is the difference to CVE-2026-56164?<\/strong><\/summary>\n
56164 is an EoP (Exploit) with confirmed exploitation in the wild. 55040 is the JSON Web Token authentication bypass with CVSS 9.1 and chain potential to RCE.<\/p>\n<\/details>\n
\nWhich mitigation counts besides the patch?<\/strong><\/summary>\n
Reduce internet exposure, enable AMSI for SharePoint, monitor admin accounts, and alert on unusual site operations.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/kritis-lieferkette-zulieferer-resilienz-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>Weakest Supplier Opens Critical Facility<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/cover-hero-8-250x143.jpg\")
<\/span>Editor’s Pick<\/span>A Signed Driver Makes Endpoint Protection Blind<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/was-ist-kritis-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>What Is Critical Infrastructure? Operators, Duties & Thresholds<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-wenn-gpus-den-saas-etat-auffressen-24878004.jpg\")
<\/span>cloudmagazin<\/span>When GPUs Devour the SaaS Budget<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-wann-sich-deutsches-ki-modell-rechnet-45689807-250x143.jpg\")
<\/span>MyBusinessFuture<\/span>When a German AI Model Truly Pays Off<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-die-rechnung-fuer-zehn-jahre-inselloesun-7073350-250x141.jpg\")
<\/span>Digital Chiefs<\/span>The Bill for Ten Years of Island Solutions<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"CVE-2026-55040: Unauthenticated SharePoint JWT bypass (CVSS 9.1). Rapid7 exploit chain, July patch, and checklist for on-prem admins.","protected":false},"author":10,"featured_media":22103,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"SharePoint JWT bypass CVE-2026-55040","_yoast_wpseo_title":"SharePoint JWT Bypass Exposes On-Premises Sites","_yoast_wpseo_metadesc":"CVE-2026-55040: Unauthenticated SharePoint JWT bypass (CVSS 9.1). Rapid7 exploit chain, July patch, and on-prem admin checklist.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-22168","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":22102,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22168"}],"version-history":[{"count":2,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22168\/revisions"}],"predecessor-version":[{"id":24276,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22168\/revisions\/24276"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22103"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - ✓<\/span>Inventory internet\u2011exposed SharePoint instances and kill exposure<\/li>\n
- Identity is sufficient.<\/strong> The target user’s SID or UPN is enough as a prerequisite for impersonation.<\/li>\n