SharePoint attackers exploit authentication bypass before triggering remote code execution on vulnerable servers.
CVE-2026-55040 and CVE-2026-63520 affect multiple on-premises SharePoint Server editions.
Microsoft urges organizations to patch systems and investigate potential signs of compromise.
Microsoft SharePoint users face a serious security threat after attackers began targeting a chain of two vulnerabilities that can allow unauthenticated remote code execution on vulnerable, unpatched servers.
The exploit chain consists of CVE-2026-55040, a critical flaw that allows bypassing the authentication process, and CVE-2026-63520, a remote code execution vulnerability in Business Connectivity Services (BCS) within SharePoint.
Both vulnerabilities have public PoCs (proof-of-concept exploits), which pose an increased danger for organizations running internet-facing, on-premises SharePoint servers.
CVE-2026-55040 is the first vulnerability, with a CVSS score of 9.1. The vulnerability lies in the JWT token validation process in SharePoint, allowing an attacker to bypass authentication and perform actions under the identity of a SharePoint site administrator or user.
The second vulnerability, CVE-2026-63520, has received a CVSS score of 8.1. The second vulnerability is present in Business Connectivity Services in SharePoint and concerns insecure .NET type instantiation.
After bypassing the authentication process, the attacker will exploit the second vulnerability to run code on the target SharePoint server remotely. This combination allows the attacker to achieve remote code execution
CVE-2026-55040 is associated with the vulnerabilities in the SharePoint JSON Web Token (JWT) authentication mechanism. The flaw enables attackers to generate a JWT that masquerades as SharePoint users, including privileged users, without using legitimate credentials.
To do so, the attacker requires specific data about the target account, such as its Active Directory Security Identifier (SID) or User Principal Name (UPN).
Once the attacker acquires an authenticated session via the aforementioned vulnerability, they will be able to access Business Connectivity Services’ functionality. Then, with the help of CVE-2026-63520, the attacker can trigger unsafe .NET type creation.
The threat is no longer limited to theoretical exploitation. Threat intelligence company Defused reported attacks targeting the exploit chain against SharePoint servers.
The activity included attempts to exploit the authentication-bypass and probing functionality associated with the Business Data Catalog, which sits at the core of Business Connectivity Services.
VulnCheck researchers also developed an exploit chaining the two vulnerabilities. The company reported at least 8,500 SharePoint servers online after removing honeypots and deduplicating internet-facing systems.
CVE-2026-55040 was also exploited shortly after Rapid7 security researcher Stephen Fewer published a proof of concept on August 11. Rapid7’s research showed how the authentication bypass could be combined with the separate RCE vulnerability.
Also Read: Microsoft Says Learning to Code Matters More Than Ever in AI Era
The vulnerabilities affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise.
SharePoint Online is not affected by this particular vulnerability chain.
Microsoft’s August security updates address CVE-2026-63520 and related SharePoint vulnerabilities. Affected versions should be updated to the following builds:
SharePoint Server Subscription Edition: 16.0.19725.20522
SharePoint Server 2019: 16.0.10417.20198
SharePoint Server 2016 Enterprise: 16.0.5565.1001
Microsoft’s August 11 security update for SharePoint Server Subscription Edition specifically lists CVE-2026-63520 as one of the vulnerabilities addressed. The SharePoint Server 2019 update also lists CVE-2026-63520 and confirms build 16.0.10417.20198.
Also Read: How AI Is Keeping Microsoft's China Business Alive
Why this MattersThe exploit chain combines authentication bypass with remote code execution, potentially granting attackers unauthorized access to the server. Public exploits and active targeting make immediate patching critical for organizations.
The threat involves both an authentication bypass and a remote code execution vulnerability. To exploit the vulnerabilities, the attacker doesn’t need to use legitimate SharePoint credentials. The first vulnerability allows the attacker to bypass authentication, while the second enables remote code execution.
The problem is especially dangerous since exploits for these vulnerabilities are already publicly available, and there have been reports of attempts to exploit them. The Cyber Security Agency of Singapore stated that the vulnerabilities are currently being exploited and recommends immediate patching.
It goes without saying that to ensure the safety of the SharePoint system, all security updates should be installed.
What is the latest Microsoft SharePoint vulnerability?
The latest threat involves CVE-2026-55040 and CVE-2026-63520, forming an exploit chain that leads from an authentication bypass to remote code execution.
Which SharePoint versions are affected?
SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise are affected. SharePoint Online remains unaffected.
Can attackers exploit SharePoint without credentials?
Yes. CVE-2026-55040 can allow unauthenticated attackers to bypass authentication before exploiting functionality linked to remote code execution.
Why is the SharePoint exploit chain dangerous?
The chain combines authentication bypass with RCE, potentially giving attackers a direct route to execute arbitrary code on vulnerable servers.
How can organizations protect SharePoint servers?
Organizations should install Microsoft's latest security updates, reduce unnecessary internet exposure, and investigate vulnerable systems for signs of compromise.