Microsoft SharePoint RCE Chain Actively Exploited as PoC Exploits Go Public
A pair of vulnerabilities in Microsoft SharePoint is being actively exploited in the wild, chained together to achieve remote code execution on internet-facing servers. The two flaws — CVE-2026-55040 and CVE-2026-63520 — have drawn urgent attention from both security researchers and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which ordered federal agencies to patch by August 18.
The attack chain is particularly dangerous because it starts with an authentication bypass. CVE-2026-55040 is a JSON Web Token (JWT) validation flaw that lets an unauthenticated attacker impersonate an administrator, effectively granting them the ability to perform privileged operations without ever logging in. Once that foothold is established, CVE-2026-63520 — a vulnerability in the Business Connectivity Services (BCS) component — is leveraged to escalate to full remote code execution.
Public Exploits Are Already Circulating
Proof-of-concept exploits for the chain have been published by multiple research teams. Rapid7 released its analysis on August 11, and VulnCheck followed with its own PoC on August 24. The public availability of working exploits dramatically lowers the barrier to entry, meaning even low-sophistication attackers can now weaponize the chain against unpatched targets.
Shadowserver, which tracks internet-exposed services, has identified more than 8,700 SharePoint servers reachable from the public internet. That is a substantial attack surface, and each of those servers represents a potential entry point into an organization's internal network and document repositories.
Attackers Are Already Probing
Security researchers monitoring honeypots have observed attackers actively probing for the JWT bypass, often combined with attempts to enumerate administrative accounts. This reconnaissance pattern suggests that threat actors are systematically scanning for vulnerable SharePoint deployments and testing whether the authentication bypass works before moving to the RCE stage.
The combination of a public PoC, a large exposed attack surface, and active scanning is the classic recipe for widespread compromise. SharePoint servers frequently hold sensitive documents, financial data, and internal communications, making them high-value targets for both ransomware operators and data-theft groups.
Why SharePoint Is a Prime Target
SharePoint's complexity works against it from a security standpoint. It is a sprawling platform with numerous components — BCS, workflows, web parts, and authentication layers — each of which can harbor its own vulnerabilities. Organizations often run SharePoint on-premises or in hybrid configurations where patching is slower and less consistent than in fully managed cloud environments.
The JWT bypass is a particularly insidious class of flaw because it attacks the trust mechanism itself. JSON Web Tokens are meant to be cryptographically signed so that a server can verify a client's identity without a database lookup. When the validation logic is flawed, an attacker can forge a token that the server accepts as legitimate, effectively minting their own administrator credentials on demand.
An authentication bypass in a document management platform is especially damaging because it undermines the trust boundary that everything else depends on. If an attacker can present themselves as an administrator, they can read, modify, and exfiltrate documents, create new accounts, and pivot to other systems that trust the SharePoint server.
What Should You Do?
If you operate SharePoint, treat this as an emergency. Apply the vendor patches immediately, prioritizing any server that is reachable from the internet. Use Shadowserver's data or your own asset inventory to identify every exposed SharePoint instance, and verify that none of them are running outdated builds.
Beyond patching, review your SharePoint authentication logs for signs of the JWT bypass — look for administrative actions performed by accounts that should not have that level of access, or unusual token validation failures. Consider placing SharePoint behind a VPN or a WAF with strict access controls if it does not need to be publicly reachable. Finally, assume that any unpatched server exposed during the active exploitation window may already be compromised, and plan for a forensic review rather than just a patch-and-move-on response.
