SharePoint bug let attackers log in as any user

Published August 12, 2026 CVE-2026-55040

Microsoft SharePoint had a bug that let an attacker log in as any user, including an administrator, without a password. All the attacker needed was that person's account name.

Severity
CriticalCVSS 3.1 · 9.1
Fix
Fixed in 16.0.19725.20434Fix recorded on Aug 26, 2026
Affected versions
16.0.0 to before 16.0.5561.1001; 16.0.0 to before 16.0.10417.20175; 16.0.0 to before 16.0.19725.20434
Weakness
CWE-1390
Exploit likelihood
51% in 30 daysEPSS, higher than 99% of known flaws
Affects
Microsoft SharePoint Enterprise Server 2016+2 more
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 18, 2026
Federal fix deadline
Aug 21, 2026

How it works

SharePoint checks a visitor's identity using a JWT token, a small signed pass that proves who someone is, but its checking process had several flaws, so a forged or manipulated token could be accepted as if it came from a real logged-in user.

What to do

Check your SharePoint server's build number and compare it against 16.0.19725.20434; anything earlier is vulnerable to this authentication bypass.

Install the Microsoft update that brings SharePoint to build 16.0.19725.20434 or later through normal Windows/SharePoint update channels, then confirm the new build number afterward.

Technical details

Affected software: Microsoft SharePoint Enterprise Server 2016by Microsoft, Microsoft SharePoint Server 2019by Microsoft, Microsoft SharePoint Server Subscription Editionby Microsoft

CVE-2026-55040 (CVSS 9.1, CWE-1390 Weak Authentication) is a flaw in SharePoint's JWT validation pipeline. An unauthenticated remote attacker who knows a target's AD SID or UPN can craft input that the token pipeline wrongly accepts, letting them assume that user's identity and perform actions as a site user or administrator. Rapid7 discovered this as the first stage of a two-bug chain built for Pwn2Own Berlin; the second bug, expected to enable unauthenticated remote code execution when chained with this one, is slated for an August 2026 Microsoft patch. This CVE alone is fixed in build 16.0.19725.20434.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source