Microsoft SharePoint RCE Chain Exploited as Attackers Probe Critical CVE-2026-55040 Flaw

Microsoft SharePoint administrators are being urged to patch internet-facing on-premises servers immediately after security researchers observed attackers probing a vulnerability chain that can provide unauthenticated remote code execution.

The attack chain combines CVE-2026-55040, a critical authentication-bypass vulnerability, with CVE-2026-63520, a high-severity remote code execution flaw. Both vulnerabilities affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online is not affected.

The situation became more urgent after threat intelligence company Defused reported on August 25 that its honeypots were receiving probes targeting the complete exploit chain.

Microsoft SharePoint RCE Chain

According to the observations, attackers exercised the JWT authentication bypass associated with CVE-2026-55040, followed by extensive enumeration of administrator accounts and probing of the Business Data Catalog functionality associated with CVE-2026-63520.

Defused said it had not observed successful code execution during those particular attempts, indicating that attackers were actively testing the chain against exposed environments.

CVE-2026-55040 carries a CVSS v3.1 score of 9.1 Critical and affects SharePoint’s JSON Web Token authentication handling.

The vulnerability allows an unauthenticated network attacker to bypass a security feature and potentially authenticate as a SharePoint user or administrator.

Microsoft identifies the weakness as weak authentication, while security researchers have demonstrated how improperly configured token validation can be abused to forge authentication tokens.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 18, confirming that exploitation was already occurring.

The second vulnerability, CVE-2026-63520, has a CVSS v3.1 score of 8.1 High and affects SharePoint’s Business Connectivity Services (BCS).

BCS enables SharePoint to interact with external business data and applications. Before Microsoft’s fix, attackers could manipulate a Business Data Connectivity model to provide an arbitrary class name instead of being restricted to approved types.

Security researchers found that this behavior could be abused to instantiate a .NET deserialization gadget involving System.Web.UI.LosFormatter, ultimately creating a path to arbitrary code execution.

The significance of the two vulnerabilities comes from their ability to be chained together. CVE-2026-55040 can provide the authentication bypass and impersonation capability needed to reach functionality that would otherwise require an authenticated SharePoint session.

CVE-2026-63520 can then provide the code-execution component. VulnCheck documented the combined chain on August 24, while Censys subsequently confirmed that a working exploit chain was publicly available.

The potential attack surface is substantial. Censys reported approximately 329,000 SharePoint instances visible in its measurements on August 25, including roughly 21,000 on-premises deployments exposing version information.

Separately, Shadowserver was tracking more than 8,700 SharePoint servers exposed online. Internet-facing installations therefore represent an especially urgent patching priority.

Microsoft has released fixes for all affected on-premises editions. Administrators should install the applicable security updates, verify that the patched builds are deployed successfully, and minimize direct internet exposure wherever possible.

Fixed builds include 16.0.19725.20434 for Subscription Edition and 16.0.10417.20175 for SharePoint 2019 for CVE-2026-55040, while CVE-2026-63520 is fixed in later builds including 16.0.19725.20522 and 16.0.10417.20198.

Security teams should also review SharePoint authentication logs for unusual JWT activity, unexpected administrator enumeration, suspicious Business Data Catalog requests, and anomalous processes originating from SharePoint servers.

Because CVE-2026-55040 is already listed in CISA’s exploited-vulnerability catalog and the complete RCE chain is publicly documented, organizations should treat these vulnerabilities as an active intrusion risk rather than routine patching items.