CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)

A critical authentication bypass vulnerability, designated as CVE-2026-55040, has been discovered in Microsoft SharePoint, allowing unauthenticated attackers to bypass JWT token authentication. This vulnerability, found by Rapid7 Labs, can be chained with another exploit to achieve remote code execution on a vulnerable SharePoint server. Microsoft has already patched this specific issue, but the related RCE component is still pending a fix, expected in the August 2026 update cycle. The vulnerability was uncovered as part of a zero-day research project and was also developed as an entry for the Pwn2Own competition. Microsoft is actively discussing the exploitation status of CVE-2026-55040, which will determine whether immediate patching is required or if monitoring is sufficient¹. This matters to security practitioners because the exploitation status of this vulnerability will dictate the urgency of the patching effort, making it crucial to stay informed about the latest developments and updates from Microsoft.