CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11. Within 24 hours, threat intelligence firm Defused confirmed exploitation attempts against its SharePoint honeypots using that same PoC. Over 8,500 SharePoint servers remain reachable from the open internet, putting unpatched instances at immediate risk.
The vulnerability is one half of a larger exploit chain. Chained with CVE-2026-63520, a remote code execution vulnerability, it gives an attacker full control of a vulnerable SharePoint server with zero credentials. Rapid7 Labs discovered and weaponized both vulnerabilities as part of a research project. The goal was to test whether an AI agent, guided by human researchers, could find and weaponize a real exploit chain. It could.
The chain was built as an entry for Pwn2Own Berlin and disclosed to Microsoft through a coordinated process. CVE-2026-55040 was patched in July 2026, CVE-2026-63520 in August 2026.
Risk Analysis: CVE-2026-55040
Critical
9.1
Yes
Low
Yes
Fixed, July 2026 (KB5002882 / KB5002883 / KB5002891)
Risk Analysis: CVE-2026-63520
High
8.1
Requires prior access unless chained
Not confirmed
Root cause and chain documented alongside CVE-2026-55040’s PoC
Fixed, August 2026
Inside the CVE-2026-55040 / CVE-2026-63520 Exploit Chain
CVE-2026-55040 targets the JWT authentication validation pipeline, while CVE-2026-63520 affects the vulnerable code path used for remote code execution. That makes it a natural target: it is present on every SharePoint farm, it processes external input by design, and it sits close to the identity layer.
CVE-2026-55040 breaks the first barrier. SharePoint’s JWT validation pipeline has multiple vulnerabilities that allow an unauthenticated attacker to bypass JWT authentication and impersonate a SharePoint user.
CVE-2026-63520 breaks the second. With a valid-looking identity in hand, the attacker reaches an unsafe .NET type instantiation path in Business Connectivity Services. Improper input validation (CWE-20) lets the attacker’s payload get instantiated as a live .NET object. That instantiation is what ultimately turns into arbitrary code execution, running as the SharePoint site’s service account.
Neither vulnerability alone reaches unauthenticated RCE. The authentication bypass without the RCE gets an attacker inside as a user. The RCE without the authentication bypass still needs some form of access to trigger. Chain the two together and both barriers disappear. An attacker needs no credentials, and no user interaction, to execute code on the server.
CVE-2026-55040 carries a CVSS vector of network-based, low complexity, no privileges required, no user interaction. Chained with CVE-2026-63520, the attacker can satisfy the authentication prerequisite and reach the vulnerable functionality without legitimate credentials.
What CVE-2026-55040 and CVE-2026-63520 Affect
Both vulnerabilities affect SharePoint Server Subscription Edition, 2019, and 2016. CVE-2026-63520 also reaches certain versions of Project Server and Office Web Apps Server. SharePoint Online is not affected; this is an on-premises vulnerability only.
No confirmed in-the-wild exploitation of this exploit chain has been publicly reported at the time of writing. CVE-2026-55040 on its own is being actively exploited (see below); CVE-2026-63520 has not been observed in independent attacks.
What Has Happened Since Patch Release
Researchers disclosed full technical detail on CVE-2026-55040 on August 11, 2026, laying out how an unauthenticated attacker can bypass Sharepoint’s JWT authentication and establish an authenticated session. The root cause traces back to the server’s Bearer token parsing logic for service-to-service authentication, where identified four distinct vulnerabilities that stack together to defeat the entire validation process. One of the simplest: SharePoint would accept a token declaring no signature algorithm at all the server never checked for a signature in the first place.
Real-world attackers moved almost as fast as the disclosure. Threat intelligence firm Defused reported the next day that its SharePoint honeypots were already logging exploitation attempts built directly on Rapid7’s released code. CVE-2026-55040 is now the fifth SharePoint vulnerability exploited this year, joining CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522, a pattern that has made on-premises SharePoint one of the most actively targeted platforms of 2026.
For detection, security teams can review IIS logs for unusual calls to the SharePoint context-info endpoint or unexpected bearer-token traffic patterns consistent with forged session establishment.
CVE-2026-55040 and CVE-2026-63520: Patch and Remediation Steps
Blocking this exploit chain takes more than a single update. Here is what to check and patch, in order:
Apply the July and August 2026 security updates
Patch SharePoint Server Subscription Edition, 2019, and 2016. The July update alone breaks the exploit chain even before the RCE half is patched, so don’t treat it as optional if you haven’t applied August’s yet.
Check Project Server and Office Web Apps Server
Confirm which versions are in scope for CVE-2026-63520 alongside SharePoint.
Confirm build numbers after patching
SharePoint’s multi-step configuration process has to be completed on every farm server.
Review for signs of prior compromise
Look for unexpected administrator activity, unfamiliar web shells, or unusual processes tied to the SharePoint service account.
Harden SharePoint regardless of patch status
CISA is urging this as a baseline: avoid exposing SharePoint Central Administration to the internet, restrict farm and database traffic to systems that need it, and place any internet-facing SharePoint deployment behind a Layer 7 reverse proxy or equivalent control that can authenticate and inspect requests.
Note the end-of-support timeline
If you are still running SharePoint Server 2016 or 2019, both reached end of extended support in July 2026. Patching keeps you safe from this chain; it doesn’t extend the support lifecycle or guarantee a fix for the next one.
AppTrana Coverage for CVE-2026-55040 and CVE-2026-63520
AppTrana blocks exploitation attempts targeting this vulnerability chain. Customers running SharePoint behind AppTrana stay protected while patching is completed across the farm. AppTrana WAAP inspects incoming requests to internet-facing SharePoint instances and blocks traffic that matches known malicious patterns, including forged authentication tokens and attempts to abuse Business Connectivity Services endpoints.
A malicious request targeting SharePoint’s authentication endpoint, blocked by AppTrana before it reached the server.
