WARNING: Critical Microsoft SharePoint Exploit Chain Discovered

Attackers are actively probing internet-exposed Microsoft SharePoint servers for a newly documented vulnerability chain capable of bypassing authentication and delivering remote code execution, intensifying pressure on organisations that have not yet installed Microsoft’s July and August 2026 security updates.

The emerging activity combines two vulnerabilities: CVE-2026-55040, a critical authentication bypass in SharePoint’s JSON Web Token validation process, and CVE-2026-63520, a high-severity flaw in SharePoint Business Connectivity Services that can be abused to execute arbitrary code.

Although each vulnerability has a different technical purpose, their combined effect is significantly more dangerous. The first can allow an unauthenticated attacker to impersonate a legitimate SharePoint user or administrator. The second can then provide a path from that privileged SharePoint access to code execution on the underlying server.

Threat-intelligence company Defused reported on August 25 that its honeypots had received requests consistent with the two-stage attack chain. The observed activity began with attempts to exploit the JWT authentication bypass, followed by extensive administrator enumeration and probing of the Business Data Catalog functionality associated with CVE-2026-63520.

Defused said it had not observed successful code execution during those specific honeypot interactions. That distinction is important: the activity confirms that attackers are exploring or validating the complete chain, but it does not by itself prove that every probe resulted in a compromised SharePoint server.

Nevertheless, the appearance of public proof-of-concept code for both vulnerabilities substantially lowers the technical barrier to exploitation. It also increases the likelihood that scanning, exploit development and opportunistic attacks will accelerate as threat actors incorporate the techniques into automated tools.

Two vulnerabilities combine to create an unauthenticated RCE path

The first vulnerability, CVE-2026-55040, was disclosed by Microsoft and Rapid7 in July. It carries a CVSS 3.1 score of 9.1, placing it in the critical-severity category.

According to Microsoft’s security advisory, the weakness allows an unauthorised attacker to bypass a SharePoint security feature over a network. Successful exploitation can expose files and permit data modification, although Microsoft’s individual assessment of this vulnerability does not attribute a direct availability impact to it.

Rapid7’s subsequent technical investigation found that the problem was not the result of one isolated validation error. Instead, researchers identified four weaknesses in the JWT validation pipeline that could be combined to forge an accepted token.

SharePoint uses service-to-service authentication tokens containing an outer JWT with user claims and an embedded actor token representing the calling application. The actor token is supposed to be cryptographically signed by a trusted certificate. However, Rapid7 found weaknesses involving disabled signed-token requirements, insufficient actor-token signature verification, overly permissive certificate acceptance and a token-signature check that did not provide the expected cryptographic assurance.

Together, those conditions could allow a remote attacker with no valid SharePoint account to construct a token that the vulnerable server accepts as belonging to another user. Depending on the identity selected, the attacker could impersonate a highly privileged SharePoint account.

Rapid7 released a technical analysis and proof-of-concept script for CVE-2026-55040 on August 11. Reports of attempted exploitation followed within roughly a day, demonstrating how quickly working research can be adapted for malicious scanning.

The authentication bypass is serious by itself because it undermines the boundary that separates unauthenticated internet users from trusted SharePoint identities. Its full impact, however, becomes clearer when it is combined with CVE-2026-63520.

Business Connectivity Services becomes the route to code execution

CVE-2026-63520 affects SharePoint’s Business Connectivity Services, or BCS, a framework designed to connect SharePoint with external business systems such as databases, web services and .NET assemblies.

Microsoft assigned the vulnerability a CVSS score of 8.1, with the issue classified as improper input validation. Rapid7 said it affects all supported SharePoint Server versions and can allow code to run with the privileges of the SharePoint site’s service account.

The vulnerability exists because affected versions of SharePoint can instantiate unsafe .NET types supplied through Business Connectivity Services metadata. Once an attacker has obtained the necessary SharePoint privileges—potentially by exploiting CVE-2026-55040—the attacker can reach the vulnerable functionality and manipulate a Business Data Catalog model.

The Business Data Catalog, or BDC, is the underlying component that allows SharePoint to represent external line-of-business systems as SharePoint-accessible data. BDC models are commonly described through structured XML metadata defining the external system, relevant .NET classes and the methods SharePoint should invoke.

That flexibility becomes dangerous when the platform accepts types that should not be instantiated.

VulnCheck’s analysis found that the August security update added a new validation routine called ValidateSafeBcsType. The patched implementation checks requested .NET types against an allowlist identified as BCSAllowedTypeNames, blocking types that have not been explicitly approved.

Researchers examining the patched and unpatched code found that a malicious BDC model could reach .NET’s Activator.CreateInstance functionality. This could be used to instantiate attacker-selected classes and ultimately reach a method capable of deserialising attacker-controlled data, creating a route to arbitrary code execution.

CVE-2026-63520 is therefore not simply a conventional file-upload issue. It abuses legitimate SharePoint functionality intended to integrate external systems, turning the platform’s ability to load and interact with .NET objects into an execution mechanism.

In a complete attack, an adversary could first forge a JWT using CVE-2026-55040, impersonate a privileged SharePoint user, obtain the request-verification value needed for privileged actions and then interact with the Business Data Catalog to exploit CVE-2026-63520.

The result is an unauthenticated route from the network edge to operating-system-level code execution on a SharePoint server.

Public exploit development accelerates the threat

Rapid7 originally developed the vulnerability chain during research examining whether publicly available artificial-intelligence models could help discover serious flaws in a complex proprietary enterprise product.

The company said the process combined agentic AI workflows with manual code review, reverse engineering and direction from experienced security researchers. The research ultimately produced a working unauthenticated SharePoint RCE chain, which Rapid7 reported to Microsoft on May 18.

Microsoft confirmed the findings two days later and divided the remediation across two monthly update cycles. The authentication-bypass component was addressed in July, while the unsafe-type-instantiation vulnerability was fixed in August.

Rapid7 disclosed CVE-2026-63520 on August 11 but initially withheld full technical details. It later published additional information on August 24 after a third party independently released technical research.

On the same day, VulnCheck researcher Jonathan Peterson published a detailed examination of the chain and demonstrated how the authentication bypass could be connected to the Business Data Catalog vulnerability.

VulnCheck said it had developed a complete exploit alongside defensive resources including version-detection capabilities, network detection signatures and packet captures. The company estimated that at least 8,500 genuine SharePoint servers were accessible from the public internet after attempting to remove honeypots and duplicate results from its measurements.

Separately, the Shadowserver Foundation’s internet-scanning data indicated that more than 8,700 SharePoint systems were exposed online. These figures should not be treated as a count of vulnerable servers: internet scans may identify patched systems, test environments and honeypots as well as genuinely exposed, unpatched installations.

They nevertheless illustrate the size of the potential attack surface.

SharePoint servers are especially attractive targets because they frequently store sensitive documents, internal correspondence, intellectual property, employee information and operational records. They may also be connected to Active Directory, databases, identity systems and other high-value enterprise services.

A compromised SharePoint server can therefore serve as more than a source of stolen documents. Depending on its configuration and service-account privileges, it may provide a foothold for credential theft, persistence, lateral movement and attacks against other systems inside the organisation.

Exploitation confirmed for the authentication bypass

The current exploitation status of the two vulnerabilities is not identical.

CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities Catalog on August 18, confirming evidence that the authentication bypass had been used in real attacks. The designation requires US federal civilian agencies to remediate affected systems within the deadline established under Binding Operational Directive 22-01.

Microsoft has described CVE-2026-63520 as a vulnerability that attackers are more likely to exploit, but at the time of reporting, the company had not formally marked it as exploited in the wild.

The honeypot traffic reported by Defused adds evidence that attackers are investigating the complete chain. However, the company said it saw probing of the Business Data Catalog component without observing successful code execution in those interactions.

The most accurate assessment is therefore that CVE-2026-55040 is confirmed as actively exploited, while attackers are now probing infrastructure for the conditions required to extend that access into CVE-2026-63520 remote code execution.

That status could change quickly because working technical information for both stages is now public.

SharePoint remains under sustained attack

The new activity arrives during a broader wave of attacks against on-premises SharePoint deployments.

In July, CISA warned that attackers were exploiting three other SharePoint vulnerabilities—CVE-2026-32201, CVE-2026-45659 and CVE-2026-56164—against internet-accessible servers. The agency advised organisations to review Microsoft’s SharePoint security-hardening recommendations and avoid exposing on-premises SharePoint installations directly to the internet unless there is a genuine operational requirement.

CVE-2026-45659, a SharePoint remote-code-execution vulnerability involving deserialisation of untrusted data, has also been connected to ransomware activity. Its use by ransomware operators demonstrates the potential progression from initial exploitation to disruptive enterprise compromise.

The pattern is consistent with the way criminal and state-aligned attackers target enterprise collaboration platforms. Products such as SharePoint occupy a valuable position because they are often externally accessible while maintaining deep connections to trusted internal systems.

CISA has added 15 SharePoint vulnerabilities to its Known Exploited Vulnerabilities Catalog since the catalog was established in November 2021. Eight have reportedly been associated with ransomware exploitation, underscoring the continuing value of SharePoint vulnerabilities to financially motivated attackers.

The accumulation of multiple exploit chains also creates a detection challenge. An organisation that patches only the latest pair of vulnerabilities could remain exposed through an older SharePoint flaw, while a server compromised before patching may continue to contain web shells, stolen credentials or other persistence mechanisms after the software is updated.

Patches available for supported SharePoint versions

Microsoft released updates for CVE-2026-63520 as part of its August security releases. According to Rapid7’s remediation guidance, the relevant patched builds include:

SharePoint Server Subscription Edition version 16.0.19725.20522, delivered through KB5002893.

SharePoint Server 2019 version 16.0.10417.20198, covered by the applicable August updates.

SharePoint Enterprise Server 2016 version 16.0.5565.1001, covered by the relevant August updates.

Administrators should consult Microsoft’s Security Update Guide and product-update documentation to confirm that every server in the farm has received all required packages. SharePoint servicing can involve multiple updates, and installing only one component may not fully remediate an affected deployment.

Project Server and Office Web Apps Server are not affected by CVE-2026-63520, according to clarification Microsoft provided to Rapid7 after the initial disclosure.

The vulnerabilities discussed in the chain concern supported on-premises SharePoint Server products. Organisations using Microsoft’s hosted SharePoint Online service do not manage the underlying server patching process in the same way and should not assume that internet reports about vulnerable self-hosted servers automatically apply to their cloud tenants.

Patching must be combined with compromise assessment

Because CVE-2026-55040 is already known to have been exploited, installing patches should be treated as the beginning of the response rather than its conclusion.

Security teams should first identify every SharePoint server, determine whether it has been accessible from the public internet and verify the installed SharePoint build and security-update level. That assessment should include test, disaster-recovery and legacy servers that may not appear in the primary asset inventory.

Organisations should then review historical IIS and SharePoint logs for unusual bearer-token activity, unexpected requests to privileged SharePoint endpoints, administrator enumeration and abnormal interaction with Business Connectivity Services or the Business Data Catalog.

Defenders should pay particular attention to unanticipated use of endpoints involved in retrieving request-digest values, importing or modifying BDC models and invoking SharePoint’s client service processing interfaces. Unexpected changes to BCS metadata, newly created administrative identities or activity attributed to privileged accounts from unfamiliar addresses should be investigated.

Endpoint monitoring on the underlying Windows servers should also be reviewed for suspicious child processes, command execution from SharePoint or IIS worker processes, newly written executable files, unusual PowerShell activity, scheduled tasks, services and outbound network connections.

If evidence suggests that an attacker reached code execution, organisations should treat the SharePoint server as potentially compromised. Incident responders may need to isolate the affected host, preserve forensic evidence, rotate service-account and administrative credentials, examine other servers in the farm and investigate connected identity infrastructure.

Applying the update closes the vulnerability, but it does not remove attacker persistence created before remediation.

Internet exposure remains a decisive risk factor

CISA’s guidance recommends avoiding direct internet exposure for on-premises SharePoint servers unless it is operationally necessary. Organisations that must provide external access should place the service behind appropriate access controls and ensure that only required interfaces are reachable.

Network-level restrictions cannot replace patching, but they can reduce the number of systems able to interact with the vulnerable application. Access through a properly secured VPN, identity-aware proxy or tightly controlled reverse proxy can substantially narrow the exposed attack surface.

Security teams should also verify that Business Connectivity Services is required. Unused functionality should be disabled or restricted where supported, while organisations that rely on BCS should review permitted types and imported models for unexpected changes.

The rapid progression from vulnerability disclosure to public proof-of-concept code and real-world scanning shows how little time defenders now have to respond. CVE-2026-55040 was reportedly weaponised within a day of the first public exploit becoming available. Less than two weeks later, honeypots were recording attempts to investigate the complete authentication-bypass-to-RCE chain.

For organisations operating internet-facing SharePoint Server installations, the appropriate response is therefore not to wait for confirmation that CVE-2026-63520 has been successfully exploited at scale. The first vulnerability is already in CISA’s exploited catalog, the complete technical path is public, and attackers are actively testing the infrastructure needed to turn forged SharePoint access into server compromise.