# SharePoint RCE via CVE-2026-55040 & CVE-2026-63520: Patch Now

> An AI-assisted exploit chain, leveraging CVE-2026-55040 and CVE-2026-63520, enables unauthenticated RCE on Microsoft SharePoint Server. Immediate patching is critical.

- Published: 2026-08-17T00:39:44.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Microsoft SharePoint, Remote Code Execution, Vulnerability Chaining, AI in Cybersecurity, CVE-2026-55040
- CVEs: CVE-2026-55040 (CVSS 9.1), CVE-2026-63520 (CVSS 8.1)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
- Canonical: https://runtimerebel.com/blog/sharepoint-rce-via-cve-2026-55040-cve-2026-63520-patch-now

## Key points

- Unauthenticated RCE is possible on Microsoft SharePoint Servers, allowing attackers to run code as a service account.
- Affected systems include SharePoint Server Subscription Edition, 2019, 2016, Project Server 2013 SP1, and Office Web Apps 2013 SP1.
- Apply Microsoft's July and upcoming August security updates immediately, and confirm the July patch is installed.

## Overview of SharePoint [AI](/glossary#ai)-Assisted [Exploit](/glossary#exploit) Chain

Security researchers at Rapid7 have disclosed a critical, AI-assisted [exploit chain](/glossary#exploit-chain) that enables unauthenticated remote code execution ([RCE](/glossary#rce)) on Microsoft SharePoint Server. This chain leverages two distinct vulnerabilities: an identity bypass in SharePoint's JSON Web Token (JWT) validation pipeline, tracked as [CVE-2026-55040](https://nvd.nist.gov/vuln/detail/CVE-2026-55040) ([CVSS](/glossary#cvss) 9.1), and an unsafe .NET type instantiation in SharePoint's Business Connectivity Services, identified as [CVE-2026-63520](https://nvd.nist.gov/vuln/detail/CVE-2026-63520) (CVSS 8.1). Chaining these flaws allows an attacker to assume the identity of any chosen user, including an administrator, without prior authentication, and subsequently execute arbitrary code on the server.

The findings are notable not only for the severity of the exploit but also for the method of discovery. A significant portion of the research work, particularly in identifying and chaining these vulnerabilities, was facilitated by an [AI agent](/glossary#ai-agent). While the [Cybersecurity and Infrastructure Security Agency (CISA)](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) noted on July 14 that the identity bypass ([CVE](/glossary#cve)-2026-55040) was not yet known to have been exploited in the wild, the public disclosure by Microsoft and Rapid7 on August 11, alongside a proof-of-concept (PoC) script, significantly elevates the risk of future exploitation, as described by [The Hacker News](https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html).

## Technical Details and [Vulnerability](/glossary#vulnerability) Chaining

### CVE-2026-55040: Unauthenticated Identity Bypass

This vulnerability resides within SharePoint's JWT validation pipeline. Rapid7 researchers identified several issues within this pipeline that allow an unauthenticated attacker to impersonate a target user. The primary prerequisite for this attack is knowledge of the target account's Active Directory security identifier (SID) or User Principal Name (UPN), typically formatted like an email address. Rapid7's proof-of-concept demonstrated that this prerequisite is not a significant barrier, as it could enumerate users by SID from a target's domain controller and then use the bypass to identify the site administrator. CISA's assessment of this flaw highlights its automatable nature and total technical impact.

### CVE-2026-63520: Remote Code Execution

The identity bypass alone allows for privileged access, but when chained with CVE-2026-63520, it escalates to unauthenticated remote code execution. This second flaw involves an unsafe .NET type instantiation within SharePoint's Business Connectivity Services. Exploiting this vulnerability enables attackers to run code on the server under the context of the Windows service account powering the SharePoint site. This combination allows for a complete compromise of the affected SharePoint server.

### Affected Systems and Lifecycle Concerns

The exploit chain impacts several on-premises SharePoint editions:

*   SharePoint Server Subscription Edition
*   SharePoint Server 2019
*   SharePoint Server 2016
*   Project Server 2013 Service Pack 1 (CVE-2026-63520 only)
*   Office Web Apps 2013 Service Pack 1 (CVE-2026-63520 only)

SharePoint Online is not listed as affected. A critical concern for defenders is that SharePoint Server 2016 and 2019 reached their end-of-support date on July 14, 2026. Microsoft's lifecycle guidance states that products past end of support do not receive new security updates. While Microsoft and Rapid7 have confirmed fixes for these vulnerabilities, it remains unclear whether Microsoft will issue updates for these unsupported versions, leaving many organizations exposed.

## Actionable Recommendations and Mitigations

Organizations running affected SharePoint Server versions must prioritize immediate action to mitigate these critical vulnerabilities. The primary focus for **patching SharePoint Server Subscription Edition CVE-2026-55040** and other affected versions is the application of Microsoft's security updates.

*   **Apply Latest Updates Immediately**: Rapid7 states that the July update breaks the exploit chain. Organizations should confirm that the July 2026 security updates are fully installed. Furthermore, apply the upcoming August 2026 updates as soon as they become available. Keep a close watch on Microsoft's SharePoint update history for build numbers carrying these fixes.
*   **Address End-of-Support Versions**: For organizations still operating SharePoint Server 2016 and 2019, which are past their end-of-support date, the risk is significantly elevated. If Microsoft does not issue out-of-band updates for these versions, migration to a supported version or SharePoint Online should be accelerated.
*   **Monitor for Exploitation**: Although the specific exploit chain was not known to be exploited in the wild at CISA's July 14 alert, the public PoC increases the likelihood. Organizations should implement enhanced monitoring for suspicious activity on SharePoint servers, particularly around authentication attempts, service account processes, and unusual file access.
*   **Incident Response Preparedness**: Given that CISA previously highlighted active exploitation of other SharePoint flaws involving IIS machine key theft, organizations should be prepared for incident response, beyond just key rotation, if signs of compromise are detected. The ability for an AI agent to quickly identify and chain vulnerabilities underscores the evolving [threat landscape](/glossary#threat-landscape).

**Related:** [AI's Role in Cybersecurity Careers: Opportunities for Entry-Level Pros](/blog/ai-s-role-in-cybersecurity-careers-opportunities-for-entry-level-pros), [CVE-2026-8037: Progress LoadMaster Command Injection RCE](/blog/cve-2026-8037-progress-loadmaster-command-injection-rce)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/sharepoint-rce-via-cve-2026-55040-cve-2026-63520-patch-now