Rapid7Stephen Fewer
CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens
Part of the CVE-2026-55040 story · since 15 Jul
Quiet for 6 weekslast report 2 Oct16 articles5 outlets
- Wed 15 Jul, 00:51 UTC. Rapid7, first report. Patch Tuesday - July 2026. Cites a CVE in CISA KEV.
- Wed 15 Jul, 14:23 UTC. SecurityWeek, its first report on the story. CISA urges swift patching of SharePoint after zero day exploits. Cites a CVE in CISA KEV.
- Tue 11 Aug, 14:51 UTC. Rapid7. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass. Cites a CVE in CISA KEV.
- Tue 11 Aug, 14:51 UTC. Rapid7. CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens. Cites a CVE in CISA KEV. This article, 4th of 16.
- Wed 12 Aug, 09:52 UTC. SecurityOnline, its first report on the story. Critical SharePoint JWT flaw lets attackers bypass authentication. Cites a CVE in CISA KEV.
- Wed 12 Aug, 15:21 UTC. SecurityWeek. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack. Cites a CVE in CISA KEV.
- Thu 13 Aug, 09:21 UTC. Security Affairs, its first report on the story. SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release. Cites a CVE in CISA KEV.
- Tue 18 Aug, 19:43 UTC. CISA, its first report on the story. CISA flags critical SharePoint auth bypass CVE-2026-55040 in KEV. Cites a CVE in CISA KEV.
- Wed 19 Aug, 00:03 UTC. CISA. CISA Urges Patching of Microsoft SharePoint Flaw CVE-2026-55040. Cites a CVE in CISA KEV.
- Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:01 UTC. SecurityWeek. CISA warns of active exploits in Microsoft, VMware, Apple bugs. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:00 UTC. SecurityOnline. Google patches Android ContactsProvider2 SQLi high severity bug. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:01 UTC. SecurityOnline. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
- Tue 25 Aug, 15:50 UTC. SecurityOnline. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited. Cites a CVE in CISA KEV.
- Fri 2 Oct, 10:05 UTC. SecurityWeek. Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors. Cites a CVE in CISA KEV.
Rapid7 disclosed CVE-2026-55040, a serious authentication bypass vulnerability in Microsoft SharePoint, on July 14, 2026. The vulnerability allows unauthenticated attackers to forge valid JSON Web Tokens (JWT), impersonating SharePoint users or administrators due to weaknesses in the JWT token validation process.
Analysis identified four main weaknesses in the security system, including disabled cryptographic signature verification, problematic actor token validation, acceptance of unregistered certificate issuers, and non-cryptographic checks during signature verification. A proof-of-concept (PoC) script is available to demonstrate bypassing the authentication. The blog also promotes an upcoming webinar on this security research.
How the story developed
Quiet for 6 weekslast report 2 Oct16 articles5 outlets
16 articles from 5 outlets since 15 Jul. Quiet since 2 Oct. This was the 4th report, 28 days after the first.
- Wed 15 Jul, 00:51 UTC. Rapid7, first report. Patch Tuesday - July 2026. Cites a CVE in CISA KEV.
- Wed 15 Jul, 14:23 UTC. SecurityWeek, its first report on the story. CISA urges swift patching of SharePoint after zero day exploits. Cites a CVE in CISA KEV.
- Tue 11 Aug, 14:51 UTC. Rapid7. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass. Cites a CVE in CISA KEV.
- Tue 11 Aug, 14:51 UTC. Rapid7. CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens. Cites a CVE in CISA KEV. This article, 4th of 16.
- Wed 12 Aug, 09:52 UTC. SecurityOnline, its first report on the story. Critical SharePoint JWT flaw lets attackers bypass authentication. Cites a CVE in CISA KEV.
- Wed 12 Aug, 15:21 UTC. SecurityWeek. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack. Cites a CVE in CISA KEV.
- Thu 13 Aug, 09:21 UTC. Security Affairs, its first report on the story. SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release. Cites a CVE in CISA KEV.
- Tue 18 Aug, 19:43 UTC. CISA, its first report on the story. CISA flags critical SharePoint auth bypass CVE-2026-55040 in KEV. Cites a CVE in CISA KEV.
- Wed 19 Aug, 00:03 UTC. CISA. CISA Urges Patching of Microsoft SharePoint Flaw CVE-2026-55040. Cites a CVE in CISA KEV.
- Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:01 UTC. SecurityWeek. CISA warns of active exploits in Microsoft, VMware, Apple bugs. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:00 UTC. SecurityOnline. Google patches Android ContactsProvider2 SQLi high severity bug. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:01 UTC. SecurityOnline. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2. Cites a CVE in CISA KEV.
- Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
- Tue 25 Aug, 15:50 UTC. SecurityOnline. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited. Cites a CVE in CISA KEV.
- Fri 2 Oct, 10:05 UTC. SecurityWeek. Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 16 articles as a listHide the list
- Wed 15 JulDay 02
- CISA urges swift patching of SharePoint after zero day exploits14:23 · SecurityWeek · Known exploited CVE
Quiet for 4 weeks
Tue 11 AugDay 272- Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass14:51 · Rapid7 · Picked up again · Known exploited CVE
- CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens14:51 · Rapid7 · Known exploited CVE · This article, 4th of 16
- Wed 12 AugDay 282
- Critical SharePoint JWT flaw lets attackers bypass authentication09:52 · SecurityOnline · Known exploited CVE
- SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack15:21 · SecurityWeek · Known exploited CVE
- Thu 13 AugDay 291
- SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release09:21 · Security Affairs · Known exploited CVE
Quiet for 5 days
Tue 18 AugDay 341- CISA flags critical SharePoint auth bypass CVE-2026-55040 in KEV19:43 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Wed 19 AugDay 356
- CISA Urges Patching of Microsoft SharePoint Flaw CVE-2026-5504000:03 · CISA · official · Known exploited CVE
- U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog08:01 · Security Affairs · Known exploited CVE
- CISA warns of active exploits in Microsoft, VMware, Apple bugs11:01 · SecurityWeek · Known exploited CVE
Show 3 more from 19 Aug
- Google patches Android ContactsProvider2 SQLi high severity bug14:00 · SecurityOnline · Known exploited CVE
- Urgent Patches Address Flaws in Microsoft, Apple, IBM Db214:01 · SecurityOnline · Known exploited CVE
- Telegram seeks .gram domain as critical zero day exploits surge14:02 · SecurityOnline · Known exploited CVE
Quiet for 6 days
Tue 25 AugDay 411- Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited15:50 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 5 weeks
Fri 2 OctDay 791- Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors10:05 · SecurityWeek · Picked up again · Known exploited CVE