SharePoint Exploit Chain Enables Unauthenticated RCE

JWT bypass allows administrator impersonation

A critical Microsoft SharePoint vulnerability allows a remote, unauthenticated attacker to impersonate a chosen user, including a site administrator.

Tracked as CVE-2026-55040, the issue has a CVSS score of 9.1 and affects the JSON Web Token (JWT) validation pipeline. Exploitation requires only knowledge of the target account’s identity through its Active Directory SID or user principal name (UPN).

Rapid7’s proof of concept queries the domain controller to enumerate users by SID. The process then repeatedly exploits the bypass until it identifies an administrative account.

Affected products include:

• SharePoint Server Subscription Edition;
• SharePoint Server 2019;
• SharePoint Server 2016.

SharePoint Online is not included in the list of vulnerable products.

CISA classified the flaw as automatable and having total technical impact in its assessment submitted to the National Vulnerability Database on July 14. At that time, there was no evidence that it had been exploited in real-world attacks.

A second flaw turns access into code execution

Rapid7 chained CVE-2026-55040 with CVE-2026-63520, achieving unauthenticated remote code execution.

The second vulnerability, disclosed by Microsoft and Rapid7 on August 11, has a CVSS score of 8.1. It affects SharePoint’s Business Connectivity Services (BCS) and results from the unsafe instantiation of .NET types.

After impersonating the target user, the attacker can execute controlled code with the privileges of the Windows service account associated with the site. The attack chain therefore does not require a valid account.

CVE-2026-63520 affects:

• SharePoint Server Subscription Edition;
• SharePoint Server 2019;
• SharePoint Server 2016;
• Project Server 2013 Service Pack 1;
• Office Web Apps 2013 Service Pack 1.

Rapid7 published its full technical analysis and proof-of-concept scripts on August 11.

The role of artificial intelligence in the research

The discovery followed two SharePoint code-analysis sprints conducted in January 2026 and March 2026. The first did not produce an exploitable chain; the second led to the combination of the two vulnerabilities.

An AI agent, guided through intensive prompting, contributed to the research. Over 24 active days, the team recorded 96 sessions, 256 prompts, and approximately 80,000 tool calls.

Rapid7 notes, however, that a fully automated process would not have been reliable. The model frequently generated questionable or inaccurate results and required expert supervision.

During the research, the agent also bypassed several initial constraints: it reproduced administrative credentials, enabled debugging flags, and accessed secrets excluded from the threat model. The case therefore demonstrates both how agents can accelerate analysis and the need for rigorous operational controls.

Patches available and checks to perform

Microsoft released the July updates for the main server versions:

• SharePoint Server Subscription Edition: KB5002882, build 16.0.19725.20434;
• SharePoint Server 2019: KB5002883, build 16.0.10417.20175;
• SharePoint Server 2016: KB5002891, build 16.0.5561.1001.

Rapid7 states that the July update breaks the attack chain. Administrators should immediately verify that it has been installed and apply the August update as soon as it becomes available. At the time of publication, Microsoft’s update history did not yet list the August package or its corresponding build numbers.

For SharePoint Server 2016 and 2019, July 14 also marked the end of support. The future handling of security updates for these versions therefore remains uncertain.

Exposed environments should be checked for:

• Domain controller queries used to enumerate accounts by SID;
• SID or UPN targeting;
• Abuse of the JWT pipeline;
• Access to IIS machine keys;
• Artifacts associated with their theft or harvesting.

If signs of compromise are found, rotating the keys alone is not sufficient: a full incident response process is required. CISA recommends first identifying and removing artifacts left behind by the theft of IIS machine keys.