Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Rapid7's analysis of SharePoint auth bypass CVE-2026-55040 includes a PoC for unauthenticated admin-level operations.
Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass in Microsoft SharePoint, on July 14, 2026. The flaw stems from multiple issues in SharePoint's JWT token validation pipeline, allowing a remote unauthenticated attacker to bypass authentication and perform operations as a site user or administrator. Rapid7 has now published a technical analysis and a proof-of-concept script, based on SharePoint Server Subscription Edition.
- Unauthenticated remote attackers can bypass SharePoint authentication
- JWT token validation pipeline flaws enable admin-level operations
- Rapid7 released technical analysis and PoC script
- Disclosed jointly with Microsoft on July 14, 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
From the original article
Overview On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script. Figure 1: The Rapid7 Labs PoC for CVE-2026-55040.
By Stephen Fewer · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.