CVE-2026-55040 + CVE-2026-63520 (CVSS 9.1): Attackers Now Forge SharePoint Admin Credentials — No Password Required

Your Microsoft SharePoint server may look secure from the outside — but right now, attackers are forging administrator credentials without knowing a single password. CVE-2026-55040, a critical JWT authentication bypass (CVSS 9.1) that Microsoft patched in July, is now being actively exploited in the wild after a public proof-of-concept dropped on August 12. Chain it with CVE-2026-63520 — a remote code execution flaw patched just this month — and an unauthenticated attacker on the internet can fully compromise your SharePoint farm: exfiltrate files, plant backdoors, and pivot deeper into your Microsoft 365 estate. For enterprises across India, where SharePoint underpins HR portals, legal repositories, and intranet systems, this is not a drill.

How We Got Here: A Timeline of Two CVEs

SharePoint’s authentication stack has been under siege in 2026. CVE-2026-55040 is the fifth actively exploited SharePoint vulnerability this year, joining CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522 in an alarming sequence. Stephen Fewer, Senior Principal Security Researcher at Rapid7, discovered both CVEs and worked with Microsoft on coordinated disclosure.

Date	Event
14 July 2026	Microsoft patches CVE-2026-55040 (July Patch Tuesday). SharePoint Server 2016 receives its final security update.
19 July 2026	First exploitation attempt recorded by KEVIntel telemetry — five days after patch release.
12 August 2026	Rapid7 publishes a public Python PoC exploit on GitHub and a full technical write-up.
12 August 2026	Microsoft patches CVE-2026-63520 (August Patch Tuesday), closing the RCE half of the exploit chain.
12–13 August 2026	Exploitation spike: 8 of the 12 total recorded attacks occur within 48 hours of the PoC going public, from 8 unique IPs across Hong Kong, Japan, Netherlands, Taiwan, and the U.S.
18 August 2026	CISA adds CVE-2026-55040 to the KEV catalog with a mandatory remediation deadline for federal agencies.

Technical Breakdown: Four JWT Weaknesses Chained Into One Master Key

At its core, CVE-2026-55040 is a flaw in SharePoint’s SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. Rapid7’s analysis reveals that the vulnerability is not a single bug but a chain of four independently weak JWT validation steps that, together, let an attacker mint a token the server accepts as legitimate.

1. Algorithm confusion (“alg: none”): SharePoint’s token handler does not reject JWTs with an "alg": "none" header, meaning no cryptographic signature is required at all.
2. Unverified certificate thumbprint: The server uses the attacker-supplied thumbprint in the JWT header to resolve a signing key from its own STS certificates — without validating that the thumbprint corresponds to a trusted issuer.
3. Skipped TrustedSecurityTokenServices check: The TrustedSecurityTokenServices validation for the token issuer is bypassed, so the attacker can claim any issuer identity.
4. Unsigned actor tokens accepted: Actor tokens embedded in the JWT are processed without signature verification, allowing the attacker to claim any user identity — including a site collection administrator.

The practical attack flow, per Rapid7’s public PoC: an attacker who knows a target user’s Active Directory Security Identifier (SID) or User Principal Name (UPN) — both obtainable through LDAP enumeration or public LinkedIn data — can craft a forged JWT in seconds and submit it to any SharePoint endpoint that accepts bearer token authentication. The server returns a valid session cookie granting administrative privileges.

The Full RCE Chain: CVE-2026-55040 + CVE-2026-63520

Alone, CVE-2026-55040 delivers admin-level access to SharePoint content. Chained with CVE-2026-63520 (CVSS 8.1, patched August 12), the exploit escalates to unauthenticated remote code execution on the server itself.

CVE-2026-63520 is an unsafe .NET type instantiation flaw in SharePoint’s Business Connectivity Services (BCS) component. On its own, it requires an authenticated session. But once CVE-2026-55040 provides that forged authentication token, BCS can be abused to instantiate arbitrary .NET types — resulting in full server-side code execution. Rapid7 has committed to publishing full technical details for CVE-2026-63520 by approximately September 10, 2026, giving defenders a small window to patch before the RCE technique becomes commodity knowledge.

This is, functionally, a zero-credential, over-the-internet, full-server-takeover vulnerability. For SOC teams and IT leaders, it belongs in the same threat category as Log4Shell and ProxyLogon.

Why This Matters Especially for Indian Enterprises

SharePoint Server remains deeply embedded in Indian government departments, public-sector banks, large BFSI institutions, and IT services firms — many of which are running on-premises SharePoint 2016 or 2019 rather than cloud-hosted SharePoint Online. (SharePoint Online in Microsoft 365 is not affected by these CVEs — this is an on-premises flaw.)

The threat becomes acute given three India-specific factors:

• End-of-life exposure: SharePoint Server 2016 received its final ever security patch on July 14, 2026. Any organisation still running 2016 after that date has zero future patches coming.
• Sensitive content: SharePoint farms in India routinely host employee PII, financial records, legal documents, and project IP — exactly the data ransomware actors and state-sponsored groups target.
• CERT-In compliance risk: A compromise involving personal data triggers mandatory 6-hour reporting obligations under CERT-In’s 2022 directions and could expose organisations to regulatory liability under India’s Digital Personal Data Protection Act, 2023.

The exploit chain also creates a natural pivot path: a compromised SharePoint farm typically has service accounts with elevated permissions across Active Directory, Azure AD Sync, and on-premises Exchange — making it an ideal beachhead for lateral movement. This pattern mirrors what we saw in the Microsoft Entra ID RCE chain (CVE-2026-69836) covered earlier this month, where identity infrastructure served as both the entry point and the lateral movement engine.

What You Should Do: Expert Defensive Guidance

Based on Sanjay Seth’s three decades working on enterprise security in Delhi NCR, here is the priority action list for any organisation running SharePoint on-premises:

1. Patch immediately — both CVEs, both months. Apply the July 2026 Patch Tuesday update for CVE-2026-55040 and the August 2026 update for CVE-2026-63520 to all SharePoint Server Subscription Edition, 2019, and 2016 instances. Do not treat these as separate patch cycles — the chain requires both.
2. Audit your JWT issuer trust configuration. Open SharePoint Central Administration → Security → Manage Trust. Remove any Trusted Security Token Service entries that are no longer actively used. Each unnecessary entry expands the attack surface.
3. Review Business Connectivity Services (BCS) data connections. Disable BCS connections that are not actively used in production. Reducing BCS exposure limits the RCE vector even if CVE-2026-63520 has not yet been patched.
4. Enable SharePoint Unified Audit Log and forward to your SIEM. Look specifically for FileAccessed, PageViewed, and SiteCollectionAdminAdded events from service accounts or unfamiliar UPNs. Exploitation typically involves enumerating users and escalating to site-collection admin.
5. Apply network-layer controls via your NGFWs. If you are running FortiGate, enable IPS signature updates and ensure the SharePoint-specific signatures are active. Restrict external access to SharePoint ports (TCP 80/443) at the perimeter to trusted IP ranges where operationally feasible. Similar to the Citrix NetScaler auth bypass situation earlier this year, perimeter segmentation is your first line of defence while patches are being staged.
6. If you are still on SharePoint 2016, migrate now. No future security patches will be released for SharePoint 2016. Migration to SharePoint Server Subscription Edition or SharePoint Online is no longer optional — it is a security imperative.
7. Zero-trust posture check: Verify that your SharePoint farm’s service accounts follow the principle of least privilege. A compromised SharePoint admin account should not have unrestricted access to Active Directory, email, or file servers. Micro-segmentation and conditional access policies are your insurance if exploitation occurs before patching is complete.

Frequently Asked Questions

Is SharePoint Online (Microsoft 365) affected?

No. CVE-2026-55040 and CVE-2026-63520 affect only on-premises SharePoint Server deployments — SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft’s cloud-hosted SharePoint Online was patched on Microsoft’s side without customer action required.

Does the attacker need any existing credentials or network access?

When CVE-2026-55040 is exploited standalone, the attacker needs to know a target user’s Active Directory SID or UPN — obtainable through LDAP, public directories, or social engineering. No password is required. If your SharePoint is internet-facing (accessible without a VPN), it is exposed to the internet-based exploitation attempts already observed.

How quickly can I tell if I have already been compromised?

Indicators of compromise to hunt for in your logs: unexpected SiteCollectionAdminAdded events since July 19, 2026; authentication events from service accounts at unusual hours; HTTP 200 responses to /_vti_bin/ or BCS-related endpoints from external IPs; and new Azure AD Sync credentials or service principal registrations linked to SharePoint. CISA’s advisory and Rapid7’s technical writeup contain specific IoCs.

What if we cannot patch immediately due to change management constraints?

Apply compensating controls in this order: (1) Place SharePoint behind a VPN or Zero Trust Network Access (ZTNA) gateway so it is not directly reachable from the internet. (2) Enable WAF rules blocking requests with JWT alg:none headers and unusual thumbprint patterns. (3) Disable BCS if not business-critical. (4) Increase SIEM alerting sensitivity for SharePoint admin events. Then fast-track the patch through an emergency change window — CISA’s KEV listing means federal agencies have a hard remediation deadline, and private-sector organisations should treat it the same way.

The Bottom Line

CVE-2026-55040 and CVE-2026-63520 together represent one of 2026’s most dangerous vulnerability chains for on-premises Microsoft infrastructure. The patches have existed since July and August respectively — the only reason organisations remain exposed is patch lag. With a public PoC available, exploitation will only grow more automated and widespread in the coming weeks.

If your organisation operates SharePoint on-premises and has not yet applied both patch cycles, treat this as a P0 incident in progress. The question is not whether attackers will attempt exploitation — they already are. The question is whether your defences are in place before you become the next case study.

---