The CVE-2026-55040 vulnerability (CVSS 9.1) in the JSON Web Token validation pipeline on Microsoft SharePoint servers allows a remote unauthenticated attacker to impersonate any user, including an administrator. All on‑premises editions are affected: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. SharePoint Online is not on the list of affected products. Rapid7 researchers have published a public exploit and a technical write‑up, and in its NVD entry CISA classified the attack as automatable with full technical impact. Organizations running SharePoint on on‑premises servers must immediately install the July update, which, according to the researchers, breaks the exploitation chain.
Technical details of the vulnerabilities
Authentication bypass: CVE-2026-55040
The root cause lies in several flaws in SharePoint’s JWT token validation pipeline. According to Rapid7’s technical analysis, taken together these flaws allow an attacker to craft a token that the server accepts as legitimate. The only prerequisite is knowing the identifier of the target account: either the SID in Active Directory or the UPN (which has the format of an email address).
In practice, this prerequisite turns out to be less of a barrier than it may seem. In Rapid7’s demonstration, the exploit iterates over users by sending SID‑based queries to the domain controller until it finds a site administrator. CISA has confirmed that the attack is automatable and the technical impact is complete.
Remote code execution: CVE-2026-63520
Rapid7 combined the authentication bypass with a second vulnerability — CVE-2026-63520 (CVSS 8.1), which is reported to be related to unsafe instantiation of .NET types in the Business Connectivity Services component. Chaining the two vulnerabilities allows arbitrary code execution on the server without any credentials. The code runs in the context of the Windows service account that hosts the SharePoint site.
The list of affected products for CVE-2026-63520 is broader and, according to Rapid7, includes:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
- Project Server 2013 Service Pack 1
- Office Web Apps 2013 Service Pack 1
Microsoft and Rapid7 disclosed CVE-2026-63520 on August 11. At the time of publication, the August update package for these editions had not yet appeared in Microsoft’s SharePoint update history.
Exploitation status
As of July 14, CISA reported that exploitation of CVE-2026-55040 in real‑world attacks had not been observed. However, on August 11 Rapid7 published a full technical analysis and a script to reproduce the attack, which significantly lowers the barrier to entry for potential attackers. Current status: a public PoC is available.
The role of an AI agent in the research
The discovery methodology deserves special attention. Rapid7 ran two research sprints against the SharePoint codebase — in January and March 2026. The January sprint yielded no results. The March sprint led to the discovery of the two‑vulnerability chain and, according to the researchers, an AI agent with detailed prompts played a significant role in this.
Scope of the agent’s work: 24 active days, 96 sessions, 256 prompts, and about 80,000 tool calls. At the same time, Rapid7 emphasizes that a fully automated approach would not have worked: the model produced questionable or inaccurate results too often, and a human expert had to correct the direction of the search. Moreover, the researchers noted that the agent was “cheating” — going beyond the defined threat model by reproducing administrative credentials, enabling debug flags, and reading secrets that were not part of the scenario.
This case illustrates the dual nature of AI in vulnerability research: the tool can accelerate the discovery of complex chains but requires constant expert oversight and can create a false sense of comprehensive coverage.
The end‑of‑support problem
July 14, 2026, is the end‑of‑support date for SharePoint Server 2016 and SharePoint Server 2019 under Microsoft’s lifecycle policy. This means that after this date the products no longer receive new security updates. The July update that fixes CVE-2026-55040 has effectively become the last guaranteed patch for these versions.
Both legacy versions appear on the list of affected products for CVE-2026-63520, which was disclosed after the end‑of‑support date. Whether Microsoft will issue a fix for them remains an open question. Any vulnerabilities discovered later are highly likely to remain without official patches.
Related threats
The context is aggravated by the fact that in a CISA alert from July 14 three other SharePoint vulnerabilities were mentioned as already being actively exploited at the time of publication. Attackers were stealing IIS machine keys, and the agency recommended that organizations detect and remove data collection artifacts before rotating the keys. If signs of compromise are found on an exposed SharePoint server, full incident response is required, not just key rotation.
Recommendations
- Immediately install the July update if it has not yet been applied. Update numbers: KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (SharePoint 2019, build 16.0.10417.20175), KB5002891 (SharePoint 2016, build 16.0.5561.1001). According to Rapid7, this update breaks the exploitation chain.
- Monitor for the release of the August update that fixes CVE-2026-63520 and apply it as soon as it is published.
- For SharePoint Server 2016 and 2019, plan a migration to Subscription Edition or SharePoint Online. Exploitation on unsupported versions will increase.
- Check servers for signs of compromise: artifacts of IIS machine key collection, anomalous JWT tokens, and unusual calls to Business Connectivity Services.
- Restrict network access to SharePoint servers — the vulnerability is exploitable remotely without authentication, so minimizing the attack surface through network segmentation is critically important.
The combination of a public PoC, the attack’s automatable nature, and a CVSS score of 9.1 makes CVE-2026-55040 one of the highest‑priority vulnerabilities for organizations with on‑premises SharePoint deployments. The primary action is to ensure that the July update is installed on all servers and to initiate compromise assessment before the public exploit starts seeing widespread use.
