CVE-2026-55040

APPLIANCE FINGERPRINT

NewScan fingerprints the Microsoft SharePoint Server appliance and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-19 from CISA KEV. Rapid7's analysis (rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040) chains four validation failures, the first of which is RequireSignedTokens=false: SharePoint Subscription Edition <=16.0.19725.20210 accepts an outer token with "alg":"none", so `GET /_api/web/currentuser` with `Authorization: Bearer <unsigned token>` answers as an authenticated user. That first weakness is a CLASS we test, not an advisory: test_jwt_forgery's alg:none arm mints exactly that token and only records when a garbage token in the same carrier was refused. Until 2026-08-19 the arm was scheduled only when the scan already HELD a JWT, so it could never fire on an anonymous scan of a SharePoint server - fixed the same day in baseline_checks._jwt_forgery_args, which now schedules the tokenless arm on any path observed to deny anonymous callers. No `lt` here: the MicrosoftSharePointTeamServices header carries a build number but the fixed build differs per supported version and we do not track it, so this stays advisory on the fingerprint and the live proof comes from the forgery check.