Security researchers are warning organizations running on-premises Microsoft SharePoint about a dangerous vulnerability chain that can turn an authentication bypass into full remote code execution.
The attack combines CVE-2026-55040, a critical SharePoint authentication bypass, with CVE-2026-63520, a vulnerability in SharePoint's Business Connectivity Services that can allow arbitrary code execution.
When combined, the two weaknesses can allow a remote attacker with no legitimate credentials to bypass authentication and ultimately execute code on a vulnerable SharePoint server.
Researchers at VulnCheck published a detailed analysis of the complete attack chain on August 24, after developing a working exploit that links the two vulnerabilities together. Both flaws were originally discovered by Rapid7 researcher Stephen Fewer.
The development is particularly significant because CVE-2026-55040 is already being exploited in the wild.
Two Vulnerabilities, One Dangerous Attack Chain
Individually, the vulnerabilities create serious security problems.
Together, their impact is substantially greater.
1️⃣ CVE-2026-55040 — SharePoint Authentication Bypass
CVE-2026-55040 is a critical authentication weakness in Microsoft SharePoint's JWT token validation process.
Microsoft assigned the vulnerability a CVSS score of 9.1.
Rapid7's analysis found multiple weaknesses in SharePoint's JWT validation logic that can allow a remote attacker to forge a token and impersonate a SharePoint user.
Depending on the information available to the attacker and the target configuration, this could include impersonating a privileged SharePoint account.
In practical terms, the vulnerability can allow an external attacker to effectively tell SharePoint:
"Treat me as an authenticated user."
The attacker does not need the victim's password.
CVE-2026-55040 affects supported on-premises editions including:
- Microsoft SharePoint Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
Microsoft released security updates addressing the flaw in July 2026.
2️⃣ CVE-2026-63520 — Code Execution Through Business Connectivity Services
CVE-2026-63520 affects SharePoint's Business Connectivity Services (BCS).
Microsoft rates the vulnerability 8.1 HIGH under CVSS 3.1 and describes it as an improper input-validation issue that can allow an unauthorized attacker to execute code over a network.
Business Connectivity Services is designed to allow SharePoint to interact with external business systems such as databases, web services and .NET components.
Researchers discovered that vulnerable versions of SharePoint did not sufficiently restrict which .NET types could be instantiated through certain BCS models.
That creates a path for an attacker with sufficient SharePoint access to introduce a malicious BCS model and cause SharePoint to perform unsafe operations.
VulnCheck demonstrated that this weakness can ultimately be turned into remote code execution under the SharePoint service account's privileges.
Microsoft addressed CVE-2026-63520 in its August 2026 SharePoint security updates.
How the SharePoint Attack Chain Works
The real danger appears when the vulnerabilities are combined.
The attack can be understood as two stages.
Stage 1: Bypass authentication
An attacker exploits CVE-2026-55040 to create a forged JWT token and gain access to SharePoint without possessing legitimate credentials.
Stage 2: Execute code
The attacker then abuses CVE-2026-63520 through SharePoint's Business Connectivity Services to trigger unsafe .NET functionality and execute code on the underlying server.
The first vulnerability removes the authentication barrier.
The second provides the code-execution capability.
The result is an unauthenticated remote code execution chain.
For organizations operating internet-facing SharePoint farms, this is a particularly dangerous combination because an attacker may potentially progress from an external web request to server-level code execution without first compromising a legitimate account.
Active Exploitation: An Important Distinction
Reports about the attack require careful interpretation.
There is confirmed evidence that CVE-2026-55040 is being exploited in the wild.
VulnCheck added the vulnerability to its own Known Exploited Vulnerabilities list on August 12, and CISA added CVE-2026-55040 to its KEV catalog on August 18, 2026. CISA classifies its exploitation status as active.
The situation involving the complete two-vulnerability chain is less definitive.
According to Cybersecurity Dive, researchers at Defused reported seeing probing activity against honeypots involving the chained sequence on August 25.
That indicates attackers or security researchers are already testing the complete attack path against internet-facing infrastructure.
However, based on currently public evidence, it would be premature to state that successful exploitation of CVE-2026-63520 as part of the full chain is already widespread.
The confirmed facts are:
- CVE-2026-55040 is actively exploited.
- A functional unauthenticated RCE chain combining both vulnerabilities has been demonstrated.
- Technical details of the chain are now publicly available.
- Probing associated with the chain has reportedly been observed.
- CISA's KEV listing currently applies to CVE-2026-55040, not CVE-2026-63520.
This distinction matters when assessing the threat accurately.
Thousands of SharePoint Servers Remain Internet-Facing
The potential attack surface is significant.
VulnCheck reported identifying at least 8,500 SharePoint servers exposed to the internet after attempting to remove honeypots and duplicate results from its measurements.
That figure does not mean all 8,500 systems are vulnerable.
It does, however, demonstrate how many SharePoint deployments may potentially be reachable directly from external networks.
For attackers, internet-facing enterprise collaboration systems are attractive targets because they can provide access to sensitive documents, credentials, internal applications and other corporate resources.
Why SharePoint Is Such a Valuable Target
SharePoint servers frequently occupy a privileged position within enterprise environments.
They may contain or connect to:
- internal corporate documents
- employee and customer information
- authentication systems
- databases
- workflow systems
- business applications
- Active Directory environments
- other Microsoft infrastructure
An attacker who obtains remote code execution on a SharePoint server may therefore attempt to move beyond the compromised application.
Potential follow-on activity could include credential theft, persistence, internal reconnaissance, data exfiltration or lateral movement.
The exact impact depends on the permissions of the SharePoint service account, network segmentation and the other systems accessible from the compromised server.
Microsoft Has Already Released Fixes
Both vulnerabilities have been patched.
Microsoft released fixes for CVE-2026-55040 in July 2026, followed by fixes for CVE-2026-63520 in the August 2026 SharePoint security updates.
The August update also introduces additional protections around Business Connectivity Services.
For example, Microsoft added stronger validation restricting the .NET types that BCS models are allowed to use.
Types that are not explicitly permitted through the BCSAllowedTypeNames allow list are blocked, reducing the opportunity to abuse dangerous .NET functionality through BCS models.
Microsoft also disabled file-backed Business Data Connectivity model imports by default in relevant August SharePoint updates as an additional security hardening measure.
What Organizations Should Do
Organizations operating on-premises SharePoint should treat this vulnerability chain as a high-priority security issue.
✅ Apply Microsoft Security Updates Immediately
Confirm that security updates addressing both CVE-2026-55040 and CVE-2026-63520 have been installed across every SharePoint server in the farm.
Do not assume that patching only one vulnerability eliminates the overall risk.
Administrators should follow Microsoft's current SharePoint servicing guidance and ensure all required cumulative and security updates are installed.
✅ Identify Internet-Facing SharePoint Servers
Organizations should determine whether SharePoint is directly reachable from the public internet.
External exposure should exist only when there is a clear business requirement.
Where possible, administrative interfaces and sensitive SharePoint services should be protected through appropriate network controls, reverse proxies, VPNs or other access restrictions.
✅ Investigate Previously Exposed Servers
Because CVE-2026-55040 is already known to be exploited, organizations should not assume that installing the patch automatically means an exposed server is safe.
Previously vulnerable systems should also be reviewed for evidence of compromise.
Defenders should examine:
- IIS and SharePoint access logs
- unusual authentication activity
- unexpected privileged SharePoint operations
- newly created or modified BCS resources
- suspicious processes launched by SharePoint or IIS service accounts
- unexpected outbound network connections
- newly created scheduled tasks or services
- unusual files or scripts placed on the server
✅ Monitor Business Connectivity Services
Organizations that use BCS should verify that legitimate models continue to operate after installing the August updates.
Microsoft's new allow-list protections may block older BCS models that rely on .NET types that are no longer permitted automatically.
Administrators should only add required and trusted types to the BCS allow list rather than broadly weakening the protection.
✅ Limit SharePoint Service Account Privileges
A SharePoint service should not have more operating-system or network privileges than it genuinely requires.
Applying least privilege can reduce the damage available to an attacker even if application-level exploitation succeeds.
✅ Segment SharePoint From Critical Infrastructure
SharePoint servers should not automatically have unrestricted access to sensitive internal systems.
Network segmentation can make it considerably harder for an attacker to turn a SharePoint compromise into a broader domain or infrastructure compromise.
Vulnerability Chaining Changes the Risk
The SharePoint disclosure is a useful example of why vulnerabilities cannot always be assessed in isolation.
CVE-2026-55040 is primarily an authentication bypass.
CVE-2026-63520 is primarily a code-execution vulnerability that requires access to relevant SharePoint functionality.
Individually, each vulnerability has limitations.
Together, those limitations largely disappear.
The authentication bypass supplies the access needed to reach the vulnerable functionality, while the second flaw transforms that access into server-level code execution.
This is one of the reasons vulnerability-management programs should consider attack chains and exploitability, rather than prioritizing vulnerabilities solely by individual CVSS scores.
Final Thoughts
The combination of CVE-2026-55040 and CVE-2026-63520 represents a serious threat to unpatched on-premises SharePoint infrastructure.
A working unauthenticated RCE chain has now been demonstrated publicly, the authentication-bypass component is already under active exploitation, and probing associated with the combined attack sequence has reportedly begun.
Organizations should therefore ensure both vulnerabilities are patched and investigate previously exposed SharePoint servers for evidence that attackers may have reached them before remediation.
The situation also reinforces an important security principle: individually constrained vulnerabilities can become far more dangerous when attackers discover ways to combine them.
Patch the complete attack path, not just individual vulnerabilities. When authentication bypass and code execution flaws can be chained together, an externally accessible business platform can quickly become a route into the wider corporate environment.
