Microsoft SharePoint Targetted

Overview

Threat actors are now probing a remote code execution (RCE) chain in Microsoft SharePoint, combining two vulnerabilities disclosed this month. According to Defused Threat Intelligence, attackers are chaining CVE‑2026‑55040 (authentication bypass) with CVE‑2026‑63520 (Business Connectivity Services flaw) to gain arbitrary code execution on unpatched servers.

Vulnerability Chain

• CVE‑2026‑55040: JWT token validation bypass allowing attackers to impersonate SharePoint users or admins without privileges.
• CVE‑2026‑63520: Business Connectivity Services vulnerability enabling RCE when chained after CVE‑2026‑55040.
• Proof‑of‑Concept exploits:
  • Published August 11 by Rapid7 researcher Stephen Fewer (CVE‑2026‑55040).
  • Published August 24 by VulnCheck researcher Jonathan Peterson (CVE‑2026‑63520).

Exploitation in the Wild

• Defused honeypots: Observed attackers exercising CVE‑2026‑55040, followed by admin enumeration and probing of BCS sinks tied to CVE‑2026‑63520.
• No confirmed RCE yet, but probing activity indicates active weaponization.
• Shadowserver data: Over 8,700 SharePoint servers exposed online, with unknown patch status.

Security Agency Warnings

• CISA advisory (August 18, 2026): Federal agencies ordered to secure SharePoint servers against CVE‑2026‑55040.
• Additional exploited flaws: CVE‑2026‑32201, CVE‑2026‑45659, CVE‑2026‑56164 flagged as actively exploited in July.
• Ransomware link: CVE‑2026‑45659 confirmed exploited by ransomware gangs.
• Since November 2021, 15 SharePoint vulnerabilities have been actively exploited, 8 linked to ransomware.

Defensive Guidance

Organizations should:

• Patch immediately: Apply Microsoft’s latest security updates.
• Harden SharePoint servers: Follow Microsoft’s official guidance.
• Restrict exposure: Avoid direct Internet exposure unless absolutely necessary.
• Monitor for exploitation: Watch for impersonation attempts, admin enumeration, and suspicious BCS activity.
• Layer defenses: Place servers behind reverse proxies or application‑layer security controls.

Expert in the Cloud Insight

The emergence of a chained RCE exploit in SharePoint underscores how attackers weaponize authentication bypass flaws as stepping stones to deeper compromise. With PoC code publicly available, defenders face a shrinking window between disclosure and exploitation. The lesson is clear: patch velocity and layered defenses are critical to securing high‑value collaboration platforms like SharePoint.