Rapid7 disclosed CVE-2026-55040 on 14 July, the authentication half of a two-vulnerability exploit chain that its Senior Principal Security Researcher, Stephen Fewer, built as an entry for the Pwn2Own Berlin hacking competition. Rapid7's advisory describes a flaw in how SharePoint validates JSON Web Tokens, letting a remote attacker who has never authenticated bypass the login process entirely and assume the identity of any SharePoint user - provided they already know that user's Active Directory Security ID or User Principal Name, an email-like identifier that is often guessable or already known to an attacker who has done basic reconnaissance on an organisation. Once impersonated, the attacker can act with that user's full permissions, including, if the identifier belongs to an administrator, with administrator rights across the site.
Half a patch, on purpose
What makes this disclosure unusual is that Microsoft and Rapid7 have deliberately only fixed and published half of what Fewer actually found. The authentication bypass chains with a second, separate vulnerability to achieve unauthenticated remote code execution - full server compromise, not just impersonation - and coverage of Microsoft's July Patch Tuesday confirms the RCE component is being held back for the August update cycle. Rapid7's own advisory is explicit that patching CVE-2026-55040 alone breaks the exploit chain, which is the justification for disclosing now rather than waiting for both halves to be ready together - but it also means the technical details of exactly how authentication bypass escalates to code execution are about to become far more interesting to reverse-engineer than they were a week ago, for exactly the same reason we flagged in our recent piece on Broadcom's vCenter flaws: once a vendor patches something, the patch itself is a roadmap for anyone working backwards from it.
Patching CVE-2026-55040 now removes the front door regardless of whether the back half ever gets weaponised independently, which is the right call for any organisation running an affected SharePoint version. But "the exploit chain is broken" and "the underlying application is fully patched" are two different claims, and it's worth being precise about which one is currently true. The RCE vulnerability still exists in an unpatched state; it's simply harder to reach without the authentication bypass as a stepping stone. An attacker who already holds a valid low-privilege SharePoint credential through some unrelated means doesn't need CVE-2026-55040 at all to go after whatever the second flaw turns out to be.
Two research sprints, and an AI research assistant, against SharePoint's codebase
The discovery process is its own small data point about where vulnerability research is heading. Rapid7 Labs ran the work as two research sprints across January and March 2026, and used AI agents extensively - across 96 sessions and roughly 256 prompts - to help analyse SharePoint's large and complex codebase for exactly this kind of subtle, multi-step authentication logic flaw. That's a defensive research team using AI-assisted analysis to find a flaw before an attacker does, the same pattern we described in our recent whitepaper on patch and vulnerability management when AI is on both sides of the fight. It's a reasonable bet that whoever eventually builds the RCE half of this chain independently, without Rapid7's head start, will be using comparable tooling to get there - which is one more reason the gap between "authentication bypass is public" and "RCE component is patched" is worth treating as urgent rather than routine.
Why the identifier requirement doesn't buy you much comfort
It's tempting to read "the attacker needs to know your Security ID or User Principal Name first" as a meaningful barrier. In most enterprise environments it isn't. User Principal Names are frequently just the corporate email address format, guessable from a company's own naming convention and a name found on LinkedIn or a press release. Security IDs are harder to guess cold, but are routinely exposed through misconfigured directory queries, old documentation, or prior low-severity information-disclosure bugs that nobody bothered patching because they looked harmless in isolation. Treating this vulnerability as low-risk because it requires "attacker knowledge" rather than "no attacker knowledge at all" is the same reasoning error that made several of this year's other management-plane flaws - including the ones we covered in Check Point's SmartConsole authentication bypass - look less urgent than they turned out to be.
- Identify every SharePoint Server 2016, 2019 and Subscription Edition instance in your estate and confirm it has the CVE-2026-55040 fix applied - this is available now and should not wait for the August RCE patch.
- Audit how easily an outsider could obtain a valid User Principal Name or Security ID for an administrator account in your directory - through email format guessing, directory misconfigurations, or old information-disclosure issues you may have deprioritised.
- Plan now to apply Microsoft's August Patch Tuesday SharePoint update as an emergency change rather than a routine one, given this specific RCE component was flagged well in advance.
- Review SharePoint access logs for anomalous JWT-based authentication activity in the weeks since 14 July, when the vulnerability's existence became public knowledge even though the patch had also shipped.
- Treat any internet-facing SharePoint Server deployment as a priority for network exposure reduction regardless of patch status - the standard advice for management-plane and identity-adjacent flaws applies here too.
Rapid7 and Microsoft made a defensible call in splitting this disclosure in two, and the half that's public is patchable today. But a chain vulnerability disclosed in two halves creates a specific, narrow window where the first half is public, actively useful to a sufficiently motivated attacker in combination with an unpatched second flaw, and openly known to be part of something bigger due in weeks. If you need help prioritising SharePoint patching and identity exposure review against that kind of staged disclosure, email sales@halfteck.com.