VulnCheck has now published a technical walkthrough of a complete exploit that joins two Microsoft SharePoint flaws into unauthenticated server code execution. On August 25, Defused observed honeypot traffic exercising the CVE-2026-55040 identity bypass, enumerating administrators, and probing the Business Data Catalog sink behind CVE-2026-63520.
Defused’s boundary is important: “No code execution observed yet.” The traffic shows that both stages are being tested against exposed systems; it does not establish successful execution, a compromised server, or a victim. CISA confirms exploitation only of CVE-2026-55040 and does not say attacks also used CVE-2026-63520. It lists ransomware use for CVE-2026-55040 as unknown.
Microsoft fixed the authentication bypass in July, then fixed the code-execution component in its August 11 updates. A farm that stopped at the July build broke the complete chain but remained exposed to the second flaw from an authenticated position. Rapid7’s August disclosure says CVE-2026-63520 affects every supported SharePoint version and certain Project Server and Office Web Apps Server versions. The primary sources do not quantify successful compromises or victims.
Two flaws complete the chain
CVE-2026-55040 is the entry point. It lets a remote, unauthenticated attacker forge SharePoint’s service-to-service identity and act as a known site user or administrator. The attacker needs an identity to impersonate, such as an Active Directory security identifier or user principal name, but needs no valid password or session.
CVE-2026-63520 supplies the execution step. Rapid7 found unsafe .NET type instantiation in SharePoint’s Business Connectivity Services, the feature that connects SharePoint to external data. A crafted .NET gadget chain can make the SharePoint site process execute an operating-system command with its Windows service-account permissions.
Together, the flaws move from an unsigned request to an authenticated SharePoint context and then to service-account code execution. CVE-2026-55040 affects SharePoint. The second flaw also reaches certain Project Server and Office Web Apps Server releases, although those products do not provide the SharePoint-only authentication-bypass path described by Rapid7.
JWT checks accept forged identity
Rapid7’s authentication-bypass analysis traces CVE-2026-55040 to several weaknesses in the JSON Web Token validation pipeline. SharePoint accepts an unsigned outer token, resolves an attacker-supplied certificate thumbprint for the nested actor token without verifying its signature, and then accepts identity claims under validation conditions the attacker can satisfy.
That sequence gives defenders a useful recognition boundary. The request is remote and unauthenticated at the network edge, yet SharePoint processes it as a chosen site identity. Authentication logs alone may therefore describe the forged user rather than the absence of legitimate proof. Web request records, the claimed user, the source address, and subsequent SharePoint operations need to be examined as one sequence.
Rapid7 published technical details and a proof of concept for this first component on August 11. Patching CVE-2026-55040 breaks the demonstrated two-part chain. It does not repair CVE-2026-63520 for attackers who already have an authenticated SharePoint foothold.
Unsafe types become server code
VulnCheck’s new analysis fills in the second stage. Its researchers diffed the August SharePoint update and found the new ValidateSafeBcsType guard around Business Connectivity Services type creation. They then built a Business Data Catalog model that reached Activator.CreateInstance with an attacker-selected .NET type and completed the chain to operating-system command execution as the SharePoint site service account.
VulnCheck says it developed a complete RCE exploit, a version scanner, Suricata and Snort rules, packet captures, and attack-surface queries. Its public report explains the mechanism; the operational exploit is restricted to customers and is not linked here. Microsoft scores CVE-2026-63520 at 8.1 with high attack complexity. Combined with the authentication bypass, the demonstrated result is critical unauthenticated remote code execution.
The chain came from an AI-assisted research project rather than a reported intrusion. Rapid7 says Stephen Fewer guided 120 hours of agent runtime across 24 days, 96 sessions, about 80,000 tool calls, and 256 prompts. The team’s Pwn2Own Berlin entry did not succeed on competition day, but the researchers later verified both flaws and coordinated their disclosure with Microsoft.
Microsoft split remediation across two scheduled cycles. Its response, quoted by Rapid7, was: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.” The July update covered the identity boundary; the August update completes the SharePoint fix and supersedes July’s cumulative SharePoint build.
Figure details
An unauthenticated request first reaches CVE-2026-55040 in SharePoint's JWT validation pipeline. A forged service-to-service identity produces a SharePoint user or administrator context. CVE-2026-63520 then abuses unsafe .NET type instantiation in Business Connectivity Services to execute an operating-system command as the SharePoint site service account. The July authentication update blocks the first stage. The August cumulative update supersedes that build and blocks the second stage.
Verify both patch layers
For SharePoint Server Subscription Edition, the August fixed build is 16.0.19725.20522 through KB5002893; it supersedes July build 16.0.19725.20434 through KB5002882. For SharePoint Server 2019, install the applicable KB5002894 and KB5002896 packages and verify build 16.0.10417.20198, superseding July build 16.0.10417.20175. For SharePoint Server 2016, install the applicable KB5002905 and KB5002906 packages and verify build 16.0.5565.1001, superseding July build 16.0.5561.1001.
Run the SharePoint Management Shell command below on every farm and compare its result with the August build for that product:
(Get-SPFarm).BuildVersion.ToString()The expected result is the August build listed above or a later cumulative build. Inventory Project Server and Office Web Apps Server separately, then use the Microsoft Security Update Guide entry for CVE-2026-63520 to apply every product-specific update shown for the installed release. Rapid7 tested SharePoint, so its research does not establish the same complete unauthenticated chain on those companion products.
On a farm that was exposed before patching, retain IIS, SharePoint ULS, Windows process-creation, and service-account authentication records. Hunt for requests that become a privileged SharePoint identity without the expected prior authentication, heavy administrator enumeration, unexpected Business Data Catalog model activity, and calls to /_vti_bin/client.svc/ProcessQuery. Correlate that sequence with child processes from SharePoint worker processes. Defused observed the identity and catalog-probing stages without execution, so the request sequence is a high-priority lead rather than proof that a command ran.
The clean verification state is a current cumulative build on every server, consistent farm versions, and no unexplained identity-to-catalog-to-process sequence during the exposure period.
The July patch is evidence that the first boundary was repaired. The August build is the test that the complete disclosed chain is closed. Farms should meet that test before administrators treat the two-cycle remediation as finished.