Microsoft SharePoint Auth Bypass Gets a Public PoC — And the RCE Chain Is Worse

• The Mess: CVE-2026-55040 is a critical authentication bypass in Microsoft SharePoint that lets a remote, unauthenticated attacker forge a valid JWT and impersonate SharePoint users — including administrators. The vulnerability is now actively exploited, according to CISA, and a public proof of concept is available.

This story got more interesting today because the technical details are now out in the open.

The bug sits inside SharePoint’s JWT validation pipeline.

And it isn’t one dumb mistake.

Rapid7 describes a chain of four separate weaknesses in the way SharePoint parses and validates nested service-to-service tokens. Combined, they allow an attacker to forge a token that SharePoint accepts as legitimate.

No password.

No existing account.

No victim clicking anything.

Just a crafted token and a vulnerable server.

The affected products include SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition before Microsoft’s fixed builds. Microsoft originally patched CVE-2026-55040 in its July 2026 security updates.

And here’s where it gets worse.

CVE-2026-55040 was originally one half of a research chain that achieved unauthenticated remote code execution against vulnerable SharePoint servers. The second flaw, CVE-2026-63520, was later patched and publicly disclosed by Rapid7.

So this is not just a story about bypassing a login screen.

It’s a story about what can happen after the login screen stops meaning anything.

• The Damage: An attacker can impersonate SharePoint users or administrators, access protected resources and, when combined with the second vulnerability in the research chain, reach unauthenticated remote code execution on a vulnerable SharePoint server.

That makes this particularly ugly for internal infrastructure.

SharePoint servers often sit in the middle of corporate environments.

Documents.

Internal portals.

Authentication workflows.

Business data.

And plenty of things that were never designed around the assumption that an anonymous internet user could suddenly become an administrator.

CISA’s status is the part administrators should not ignore.

The agency lists CVE-2026-55040 as actively exploited, not merely theoretical or PoC-only.

The public technical analysis also lowers the barrier for researchers — and attackers — to understand exactly how the JWT validation logic failed.

Once a vulnerability gets this combination:

public analysis + PoC + active exploitation

the patch window starts getting very small.

• The Fix: Install Microsoft’s SharePoint security updates immediately and make sure both CVE-2026-55040 and CVE-2026-63520 are addressed. If the server was exposed while vulnerable, investigate it as a possible compromise.

Don’t stop at checking whether Windows Update says everything is fine.

Verify the actual SharePoint build.

Check Microsoft’s update guidance for your specific edition.

And look for suspicious activity.

Pay attention to:

• unexpected administrator actions,
• unusual authentication events,
• suspicious JWT or service-to-service token activity,
• new or modified SharePoint content,
• unexpected child processes on SharePoint servers,
• web shells and strange IIS activity.

Patching closes the door.

It doesn’t tell you who walked through it before you locked it.

Bugstoday Opinion

This is why authentication bugs deserve more respect than they usually get.

People hear “authentication bypass” and think:

“Okay, someone skips a login page.”

No.

Sometimes the login page protects an entire corporate ecosystem.

In this case, the bug can let an anonymous attacker forge an identity inside SharePoint. And researchers already demonstrated that this weakness could be chained with another SharePoint flaw to reach unauthenticated RCE.

Now the technical details are public.

The PoC exists.

And CISA says exploitation is active.

That’s no longer a theoretical security discussion.

Bugstoday verdict: patch SharePoint. Check both CVEs. And if your server was exposed while vulnerable, assume the attacker may have logged in without ever needing a password.