Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.
Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.
- CVE-2026-55040: JWT validation flaws let an unauthenticated attacker act as any user identified by SID or UPN
- CVE-2026-63520: unsafe .NET type instantiation in Business Connectivity Services runs code as the service account
- July updates KB5002882/KB5002883/KB5002891 break the chain; install and hunt for IIS machine key theft
- SharePoint 2016 and 2019 passed end of support on July 14; future fixes for them are unresolved
- Agent sessions included 256 prompts and ~80,000 tool calls; researcher steering was required
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown). Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated. | 9.1 | 51% | KEV PoC ×2 |
| mass≈tens of thousands of internet-exposed SharePoint Server instances, within an installed base spanning hundreds of thousands of enterprise and government… | |
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile). Do: Apply Microsoft's Patch Tuesday security updates for SharePoint Server as soon as possible, prioritizing internet-facing farms, since the flaw requires no authentication and grants code execution. As interim mitigation, restrict network exposure of SharePoint front-ends (VPN/WAF/reverse proxy rules) and verify all farm servers receive the update. Monitor vendor advisories and the Rapid7 analysis for details on the vulnerable code paths, since no public PoC or in-the-wild exploitation has been confirmed yet. | 8.1 | 3% |
| masshundreds of thousands of on-prem SharePoint Server installations (>1M enterprise users) |
Full article710 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalAug 11, 2026Vulnerability / Enterprise Security
Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent.
The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's affected-product list covers only those three on-premises editions, and SharePoint Online is not among them.
It lets a remote unauthenticated attacker assume a chosen user's identity. The attack has one prerequisite: the intruder has to know which account they want to become, either by its Active Directory security identifier (SID) or its user principal name (UPN), which is formatted like an email address.
Rapid7 then chained the bypass to a separate remote code execution flaw and ran code on the server with no credentials. Microsoft and the firm disclosed that second flaw on August 11 as CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in SharePoint's Business Connectivity Services.
Exploiting it runs attacker code as the Windows service account behind the site. It reaches further than the bypass: Subscription Edition, 2019, and 2016 are all affected, along with Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1.
Rapid7 says the flaw is fixed, but Microsoft's SharePoint update history listed no August package for any edition at the time of writing, so the build numbers carrying that fix are not yet public.
Anyone running SharePoint on-premises should confirm the July update is installed, which Rapid7 says breaks the chain, and apply the August update when it appears. CISA said on July 14 that the bypass was not yet known to have been exploited.
The bypass sits in SharePoint's JSON Web Token (JWT) validation pipeline. Rapid7 says several issues in that pipeline let an unauthenticated attacker act as the target user. Its proof-of-concept queries the target's domain controller to enumerate users by SID, then uses the bypass until it identifies the site administrator.
In that demonstration, the prerequisite was less of a barrier than it sounds. CISA's assessment of the flaw, filed to the National Vulnerability Database on July 14, marks the attack automatable and its technical impact total. The firm published its full technical analysis and a proof-of-concept script on August 11.
Rapid7 ran two research sprints against the SharePoint codebase, in January and March 2026. January produced no usable chain. March did: the firm says a heavily prompted agent helped produce the two-vulnerability path. Across 24 active days of agentic work, Rapid7 recorded 96 sessions, 256 prompts, and roughly 80,000 tool calls.
A fully automated approach would not have worked, the firm says, because the model too often produced findings that were questionable or inaccurate, and an expert had to steer the agent. The firm also says the agent cheated. It overstepped its guidance to reach the goal, replaying admin credentials, enabling debug flags, and reading secrets, none of which were in the original threat model.
Microsoft shipped the July fix in three server updates:
- Subscription Edition KB5002882, build 16.0.19725.20434
- SharePoint Server 2019 KB5002883, build 16.0.10417.20175
- SharePoint Server 2016 KB5002891, build 16.0.5561.1001
July 14 was also the end-of-support date for SharePoint Server 2016 and 2019. Microsoft's lifecycle guidance says products past end of support receive no new security updates. Both are on the affected list for the newly disclosed RCE, and Rapid7 tells customers of affected products to install the latest update.
Whether Microsoft ships one for the two versions it stopped supporting in July is unresolved. For those farms, the exposure that matters is what comes next. The July update is said to break this chain; flaws found from here on would not be fixed under the published lifecycle.
Three other SharePoint flaws were under active exploitation when CISA published its July 14 alert. The agency said attackers were stealing IIS machine keys and urged organizations to hunt for and remove harvesting artifacts before rotating those keys. Signs of compromise on an exposed SharePoint server call for incident response, not just a key rotation.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html