← back | CVE Intelligence

CVE-2026-55040 [Critical]

Curated 2 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-55040.

Vendor: Microsoft
Product: SharePoint Server
Affected versions: SharePoint 2016 < 16.0.5561.1001; 2019 < 16.0.10417.20175; Subscription Edition < 16.0.19725.20434
CVSS: 9.1
Coverage Span: 2026-07-28 → 2026-08-11
Reports: 2 related reports

Associated Reports & Timeline

CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login

CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.

CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass

A PoC for CVE-2026-55040: exploit code that constructs an authentication header for any valid account, demonstrating a JWT authentication bypass in Microsoft SharePoint.

Why it matters: The public PoC can generate a forged authentication token for a specified account, substantially lowering the barrier to validation and reproduction. Apply Microsoft security updates immediately and test only in isolated, authorized environments.