Full research report
Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Executive assessment
The evidence supports a two-stage SharePoint chain: CVE-2026-55040 defeats service-to-service token validation and CVE-2026-63520 then crosses the Business Connectivity Services boundary to execute code. The bypass is especially urgent because public demonstration code is available and can impersonate privileged SharePoint identities without valid credentials once a target identity is known. Rapid7 and Microsoft provide corrections, and CISA had not identified exploitation of the bypass as of 14 July, but that statement predates public release of the demonstration code. Defenders should therefore treat exposed, unpatched on-premises SharePoint systems as high-priority assets while avoiding claims that this particular chain is already being used in the wild.
What happened
Rapid7 discovered an authentication bypass, CVE-2026-55040, in March 2026 and a separate remote-code-execution flaw, CVE-2026-63520, approximately two weeks later, reporting the chain to Microsoft on 18 May. Microsoft corrected the bypass in July and disclosed the second vulnerability with Rapid7 on 11 August. Chaining the flaws permits unauthenticated code execution on a vulnerable on-premises SharePoint server.
Affected scope
CVE-2026-55040 affects on-premises SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016; SharePoint Online is not identified as affected. CVE-2026-63520 affects supported SharePoint versions and certain Project Server and Office Web Apps Server versions, with reporting identifying Project Server 2013 SP1 and Office Web Apps Server 2013 SP1 among the affected products. Rapid7 lists corrected SharePoint builds 16.0.19725.20522 for Subscription Edition, 16.0.10417.20198 for 2019 and 16.0.5565.1001 for 2016.
Technical assessment
CVE-2026-55040 combines four validation weaknesses in SharePoint's bearer service-to-service JSON Web Token handling, allowing a remote unauthenticated party who can identify a target account to impersonate that SharePoint user, potentially including an administrator. CVE-2026-63520 is an unsafe .NET type-instantiation issue in Business Connectivity Services that can execute code with the SharePoint site's Windows service-account privileges. The first flaw supplies the access needed to reach the second without credentials; public code currently demonstrates the authentication bypass, not the complete code-execution chain.
Recommended defensive actions
- Apply the latest Microsoft security updates across every on-premises SharePoint server, including the July correction for CVE-2026-55040 and the August correction for CVE-2026-63520.
- Verify corrected SharePoint build levels after installation: 16.0.19725.20522 for Subscription Edition, 16.0.10417.20198 for SharePoint 2019 and 16.0.5565.1001 for SharePoint 2016.
- Inventory Project Server and Office Web Apps Server installations, then check Microsoft's CVE-2026-63520 record for applicable product updates.
- Configure Antimalware Scan Interface integration for every SharePoint web application and select Full Mode request-body scanning where feasible.
- Hunt for anomalous bearer service-to-service authentication, unexpected privileged SharePoint actions and child processes launched under SharePoint site service accounts.
- Restrict external network access to on-premises SharePoint servers until patches and corrected build levels have been validated.
Uncertainties and evidence gaps
- No verified evidence reviewed here establishes current in-the-wild exploitation of CVE-2026-55040 or CVE-2026-63520.
- Rapid7 said full technical details for CVE-2026-63520 would follow within 30 days, leaving independent technical validation of that component incomplete at disclosure time.
- The reviewed Microsoft record did not expose a complete static affected-product table for CVE-2026-63520, and the NVD record was still undergoing enrichment.
- SharePoint Server 2016 and 2019 reached end of support on 14 July 2026, creating uncertainty over remediation for future vulnerabilities even though Rapid7 listed August corrected builds for this flaw.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; public proof-of-concept code is available for CVE-2026-55040, while full technical details for CVE-2026-63520 remain withheld temporarily.
The investigation first separated the July authentication bypass from the August code-execution disclosure and tested whether the reported unauthenticated chain, affected scope and exploitation status were independently supported. Rapid7's original research established the mechanics and disclosure chronology, while Microsoft, NVD and CISA records corroborated the vulnerabilities, available correction and lack of known exploitation as of 14 July. The public repository confirmed that usable code exists for the bypass, but no reviewed evidence established current exploitation or public release of the complete code-execution chain.
- What was disclosed on 11 August, and how does it relate to the earlier SharePoint flaw?Read Rapid7's original CVE-2026-63520 disclosure.rapid7.com ↗
Rapid7 described CVE-2026-63520 as a Business Connectivity Services code-execution flaw that chains with CVE-2026-55040 for unauthenticated execution and listed corrected SharePoint builds.
why This established that the headline encompasses two distinct vulnerabilities rather than a single authentication issue.
- What causes the authentication bypass and what access does it provide?Read Rapid7's detailed CVE-2026-55040 analysis.rapid7.com ↗
Four weaknesses in bearer service-to-service token validation permit a remote unauthenticated party to impersonate a selected SharePoint user or administrator.
why This supplied the technical basis for the first stage without treating the separate code-execution flaw as part of the same weakness.
- Is the affected scope independently corroborated?Reviewed independent reporting of the disclosures and Microsoft updates.thehackernews.com ↗
The report corroborated the affected on-premises SharePoint editions, excluded SharePoint Online and identified additional products affected by CVE-2026-63520.
why Independent corroboration increased confidence in scope while highlighting end-of-support concerns for SharePoint 2016 and 2019.
- Does an authoritative vulnerability record confirm CVE-2026-55040?Read the NVD entry for CVE-2026-55040.nvd.nist.gov ↗
NVD records network-accessible weak authentication, a Microsoft CVSS 3.1 score of 9.1 and affected SharePoint Subscription Edition, 2019 and 2016 configurations.
why This confirmed the CVE identity, severity characteristics and principal affected products independently of Rapid7.
- Does an authoritative record confirm the second vulnerability?Read the NVD entry for CVE-2026-63520.nvd.nist.gov ↗
NVD records network-accessible code execution through improper input validation with a Microsoft CVSS 3.1 score of 8.1, while noting that enrichment was ongoing.
why This corroborated the code-execution claim but required caution about still-incomplete product data.
- Was the July authentication-bypass correction actually published by Microsoft?Read Microsoft's KB5002882 update page.support.microsoft.com ↗
Microsoft's 14 July Subscription Edition security update explicitly includes CVE-2026-55040 among the corrected vulnerabilities.
why This verified a concrete vendor remediation rather than relying solely on third-party patch claims.
- Was exploitation known when authorities first assessed the bypass?Read CISA's 14 July SharePoint bulletin.content.govdelivery.com ↗
CISA stated that CVE-2026-55040 was not yet known to have been exploited, while separately identifying three other SharePoint CVEs as actively exploited.
why This distinction prevents historical exploitation of unrelated SharePoint flaws from being misattributed to this story.
- Is exploit code publicly accessible?Opened the repository linked by Rapid7's technical analysis.github.com ↗
A public script demonstrates CVE-2026-55040 and supports identity discovery and impersonation against affected SharePoint systems.
why The public code raises near-term risk for unpatched systems but does not itself prove in-the-wild exploitation or publication of the full code-execution chain.
- What remediation and disclosure limits remained on 11 August?Rechecked Rapid7's remediation and disclosure sections for CVE-2026-63520.rapid7.com ↗
Rapid7 listed August corrected SharePoint versions and said full CVE-2026-63520 technical details would be published within 30 days.
why This supported specific patch validation actions while explaining why the complete second-stage technique could not yet be independently assessed.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (3 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| Rapid7news | ok3 records | Primary evidence4 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. Supplied a PoC or technical exploit reference opened and verified during focused research. |
| The Hacker Newsnews | ok15 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1665 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5323 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok680 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 7 opened outside the registered collection
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
PoC & exploit code2
Public script demonstrates unauthenticated SharePoint identity impersonation; its availability materially increases exposure for unpatched servers.
Technical write-up documents four weaknesses in SharePoint service-to-service JSON Web Token validation.
Vendor & gov advisories6
Microsoft's vendor record for the SharePoint authentication bypass.
Microsoft's vendor record for the SharePoint remote-code-execution vulnerability.
July update includes the CVE-2026-55040 correction for Subscription Edition.
CISA stated on 14 July that CVE-2026-55040 was not then known to be exploited and recommended patching, AMSI Full Mode and SharePoint hardening.
Government record confirms network-accessible weak authentication, critical severity and affected on-premises SharePoint editions.
Government record confirms network-accessible code execution through improper input validation; enrichment was still under way.
Analysis & research2
Original research describes the two-flaw unauthenticated code-execution chain, affected products, impact and fixed SharePoint builds.
Independent reporting corroborates affected SharePoint editions, July fixes and the relationship between both vulnerabilities.