Pre-Auth JWT Authentication Bypass in Microsoft SharePoint Server (CVE-2026-55040)
CISA added this SharePoint authentication bypass to KEV today with a 2026-08-21 deadline while a public Rapid7 exploit is circulating, so any unpatched on-prem SharePoint farm can be anonymously impersonated within days.
A weak-authentication flaw in SharePoint's JWT token handling lets an unauthenticated attacker make an anonymous network connection, bypass authentication, and impersonate users — allowing disclosure of files and modification of data across the farm. A public proof-of-concept exploit is available.
Affected: SharePoint Enterprise Server 2016 < 16.0.5561.1001; SharePoint Server 2019 < 16.0.10417.20175; SharePoint Server Subscription Edition < 16.0.19725.20434
How to Test
Check the farm build number in Central Administration (Servers in Farm) or via `(Get-SPFarm).BuildVersion` and compare to the fixed builds above. Review IIS logs on SharePoint front-ends for anonymous requests to authentication/token endpoints followed by authenticated activity from the same source IP, and audit ULS logs for unexpected token validation successes.
How to Patch
Install the July 2026 SharePoint security updates bringing farms to 16.0.5561.1001 (2016 — same KB covers SharePoint Server and Enterprise Server 2016), 16.0.10417.20175 (2019), or 16.0.19725.20434 (Subscription Edition), then run the SharePoint Products Configuration Wizard on every server. If external exposure is not required, restrict internet access to the farm behind VPN or an authenticating reverse proxy until patched.