Rapid7 has completed disclosure of a two-flaw Microsoft SharePoint chain that reaches server-side code execution without a valid account. Microsoft fixed the authentication bypass in July, then fixed the code-execution component in its August 11 updates. A farm that stopped at the July build broke Rapid7’s complete chain but remained exposed to the second flaw from an authenticated position.
The researchers developed the complete chain in a controlled project and did not report seeing that chain in the wild. On August 18, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog, confirming exploitation of the authentication-bypass stage. CISA does not say the attacks also used CVE-2026-63520, and it lists ransomware use as unknown. Rapid7’s August disclosure says CVE-2026-63520 affects every supported SharePoint version and certain Project Server and Office Web Apps Server versions. Neither source quantified how many deployments remain vulnerable.
Two flaws complete the chain
CVE-2026-55040 is the entry point. It lets a remote, unauthenticated attacker forge SharePoint’s service-to-service identity and act as a known site user or administrator. The attacker needs an identity to impersonate, such as an Active Directory security identifier or user principal name, but needs no valid password or session.
CVE-2026-63520 supplies the execution step. Rapid7 found unsafe .NET type instantiation in SharePoint’s Business Connectivity Services, the feature that connects SharePoint to external data. A crafted .NET gadget chain can make the SharePoint site process execute an operating-system command with its Windows service-account permissions.
Together, the flaws move from an unsigned request to an authenticated SharePoint context and then to service-account code execution. CVE-2026-55040 affects SharePoint. The second flaw also reaches certain Project Server and Office Web Apps Server releases, although those products do not provide the SharePoint-only authentication-bypass path described by Rapid7.
JWT checks accept forged identity
Rapid7’s authentication-bypass analysis traces CVE-2026-55040 to several weaknesses in the JSON Web Token validation pipeline. SharePoint accepts an unsigned outer token, resolves an attacker-supplied certificate thumbprint for the nested actor token without verifying its signature, and then accepts identity claims under validation conditions the attacker can satisfy.
That sequence gives defenders a useful recognition boundary. The request is remote and unauthenticated at the network edge, yet SharePoint processes it as a chosen site identity. Authentication logs alone may therefore describe the forged user rather than the absence of legitimate proof. Web request records, the claimed user, the source address, and subsequent SharePoint operations need to be examined as one sequence.
Rapid7 published technical details and a proof of concept for this first component on August 11. Patching CVE-2026-55040 breaks the demonstrated two-part chain. It does not repair CVE-2026-63520 for attackers who already have an authenticated SharePoint foothold.
Unsafe types become server code
Rapid7 has withheld the full technical details for CVE-2026-63520 for 30 days, but its impact statement is direct: an attacker can construct a .NET gadget chain that performs arbitrary operations, including an operating-system command, as the service account running the SharePoint site. Microsoft scores this component 8.1 with high attack complexity. Combined with the authentication bypass, the result is critical unauthenticated remote code execution.
The chain came from an AI-assisted research project rather than a reported intrusion. Rapid7 says Stephen Fewer guided 120 hours of agent runtime across 24 days, 96 sessions, about 80,000 tool calls, and 256 prompts. The team’s Pwn2Own Berlin entry did not succeed on competition day, but the researchers later verified both flaws and coordinated their disclosure with Microsoft.
Microsoft split remediation across two scheduled cycles. Its response, quoted by Rapid7, was: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.” The July update covered the identity boundary; the August update completes the SharePoint fix and supersedes July’s cumulative SharePoint build.
Figure details
An unauthenticated request first reaches CVE-2026-55040 in SharePoint's JWT validation pipeline. A forged service-to-service identity produces a SharePoint user or administrator context. CVE-2026-63520 then abuses unsafe .NET type instantiation in Business Connectivity Services to execute an operating-system command as the SharePoint site service account. The July authentication update blocks the first stage. The August cumulative update supersedes that build and blocks the second stage.
Verify both patch layers
For SharePoint Server Subscription Edition, the August fixed build is 16.0.19725.20522 through KB5002893; it supersedes July build 16.0.19725.20434 through KB5002882. For SharePoint Server 2019, install the applicable KB5002894 and KB5002896 packages and verify build 16.0.10417.20198, superseding July build 16.0.10417.20175. For SharePoint Server 2016, install the applicable KB5002905 and KB5002906 packages and verify build 16.0.5565.1001, superseding July build 16.0.5561.1001.
Run the SharePoint Management Shell command below on every farm and compare its result with the August build for that product:
(Get-SPFarm).BuildVersion.ToString()The expected result is the August build listed above or a later cumulative build. Inventory Project Server and Office Web Apps Server separately, then use the Microsoft Security Update Guide entry for CVE-2026-63520 to apply every product-specific update shown for the installed release. Rapid7 tested SharePoint, so its research does not establish the same complete unauthenticated chain on those companion products.
On a farm that was exposed before patching, retain IIS, SharePoint ULS, Windows process-creation, and service-account authentication records. Hunt for requests that become a privileged SharePoint identity without the expected prior authentication, then correlate them with unusual Business Connectivity Services activity and child processes from SharePoint worker processes. The clean verification state is a current cumulative build on every server, consistent farm versions, and no unexplained identity-to-process sequence during the exposure period.
The July patch is evidence that the first boundary was repaired. The August build is the test that the complete disclosed chain is closed. Farms should meet that test before administrators treat the two-cycle remediation as finished.