CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
Overview
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability details
SharePoint's token-based authentication accepts JSON Web Tokens (JWTs) issued by its Security Token Service (STS). CVE-2026-55040 is a CWE-1390 weak authentication flaw in which SharePoint fails to properly validate JWT signatures, allowing an attacker to forge tokens without possessing the legitimate private signing key. The STS certificate thumbprint (x5t) and realm GUID required to construct a plausible token are auto-discoverable from SharePoint's publicly accessible STS metadata endpoint, meaning no prior credentials or internal knowledge are required to begin the forgery process.
An unauthenticated remote attacker sends a crafted HTTP request to a protected SharePoint API endpoint, presenting a forged JWT in place of a legitimately issued token. The attacker first queries the STS metadata endpoint to retrieve the x5t value and realm GUID, then constructs a token naming an arbitrary identity. To impersonate a domain administrator or site admin, the attacker additionally needs network access to a domain controller via SMB/LSARPC to enumerate Windows SIDs, or must supply a known UPN. A successful bypass yields high-confidentiality and high-integrity access: the attacker can read and modify SharePoint content and configuration as the impersonated user, up to site administrator level.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor SharePoint ULS logs and IIS access logs for authenticated API requests (particularly to /_vti_bin/ and /_api/ endpoints) that have no corresponding prior login event in SharePoint or Azure AD sign-in logs, indicating a token was accepted without a normal authentication flow.
- Alert on inbound requests to the STS metadata endpoint (/_layouts/15/metadata/ or equivalent federation metadata paths) originating from IP addresses that do not subsequently appear in normal user session activity, which may indicate automated x5t and realm discovery.
- Correlate SMB/LSARPC enumeration activity against a domain controller with near-simultaneous authenticated SharePoint API requests from the same source IP, a pattern consistent with SID-based identity discovery followed by token forgery.
Remediation
Additional hardening
- Upgrade SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to build 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20434 or later. See References for the vendor advisory.
- Restrict network access to SharePoint servers so that only known, authorized clients and IP ranges can reach HTTPS endpoints; place internet-facing SharePoint deployments behind a web application firewall configured to inspect and rate-limit requests to STS metadata and API paths.
- Block or restrict SMB/LSARPC access (TCP 445) from SharePoint server network segments to domain controllers where not operationally required, reducing an attacker's ability to enumerate domain SIDs as part of the token-forgery chain.
- Audit SharePoint site collection administrator membership and apply least-privilege principles; reducing the number of accounts with site admin rights limits the impact of a successful identity impersonation.
Key dates
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-55040
- https://github.com/sfewer-r7/CVE-2026-55040
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
Frequently asked questions
Does CVE-2026-55040 affect my FedRAMP authorization?
If Microsoft SharePoint runs inside your authorization boundary, yes. CVE-2026-55040 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of August 21, 2026. For a FedRAMP-authorized service, an unpatched KEV within your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-55040?
Knox does not patch your software. Remediating Microsoft SharePoint is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The remediation work is yours to execute; maintaining a defensible compliance posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2026-55040. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal deficiency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-55040 isn't remediated by August 21, 2026?
Missing the August 21, 2026 deadline turns CVE-2026-55040 into a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what converts a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Remediating on time keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
