Attackers are actively targeting a chained exploit involving two Microsoft SharePoint vulnerabilities that together allow remote code execution on unpatched servers. The threat intelligence firm Defused reported the active exploitation attempts. A proof-of-concept (PoC) exploit is available, significantly lowering the barrier for attackers. The vulnerability chain enables arbitrary code execution without requiring high privileges. Organizations running unpatched SharePoint servers are at significant risk. The chained nature of the exploit makes it particularly dangerous as it bypasses individual mitigations. Microsoft has released patches and administrators are urged to apply them immediately. This follows a broader trend of SharePoint vulnerabilities being targeted by sophisticated threat actors.
Attackers are actively chaining two Microsoft SharePoint vulnerabilities to achieve unauthenticated remote code execution on unpatched servers. CVE-2026-55040 is an authentication bypass flaw in the JWT token validation pipeline that allows unprivileged/unauthenticated attackers to impersonate SharePoint site users or administrators. CVE-2026-63520 is a vulnerability in SharePoint's Business Connectivity Services (BCS) that, when chained after CVE-2026-55040, enables unauthenticated remote code execution on targeted SharePoint Servers. Public PoC exploits exist for both: CVE-2026-55040 PoC was published by Rapid7 researcher Stephen Fewer on August 11, and weaponized within one day; CVE-2026-63520 PoC was published by VulnCheck researcher Jonathan Peterson on August 24. By August 25, threat intelligence company Defused observed the full RCE chain being probed in honeypots, with the JWT bypass (CVE-2026-55040) exercised followed by admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520. No confirmed code execution was observed at time of reporting. Over 8,700 Microsoft SharePoint servers are exposed on the internet according to Shadowserver. Additionally, CVE-2026-45659, a separate SharePoint RCE vulnerability, has been exploited in ransomware attacks. Since November 2021, CISA has flagged 15 actively exploited Microsoft SharePoint flaws, eight of which were also exploited by ransomware gangs.
1. Apply Microsoft's security patches for CVE-2026-55040 and CVE-2026-63520 immediately on all SharePoint Server instances. 2. Follow CISA's directive (issued August 18) for federal agencies to secure SharePoint servers against CVE-2026-55040 attacks. 3. Review Microsoft's official SharePoint Server security-hardening guidance. 4. Avoid directly exposing SharePoint servers on the Internet unless absolutely necessary. 5. Monitor for signs of JWT bypass attempts and admin enumeration activity targeting Business Data Catalog/BCS components. 6. Check Shadowserver's internet-exposure tracking to assess organizational exposure. 7. Apply patches or mitigations for previously flagged SharePoint vulnerabilities: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. 8. Monitor honeypot and threat intelligence feeds (e.g., Defused, Shadowserver) for active exploitation indicators.
