What Changed
Rapid7 has disclosed a SharePoint exploit chain it built with heavy use of AI agents, originally aimed at Pwn2Own Berlin. It combines CVE-2026-55040, a JWT authentication bypass that Microsoft fixed in July, with CVE-2026-63520 (CVSS 8.1), a remote code execution flaw caused by unsafe .NET type instantiation in Business Connectivity Services. Together they give an unauthenticated attacker code execution as the SharePoint service account on on-premises servers. SharePoint Online is not affected.
How The Research Was Done
Rapid7 reports the effort took about 120 hours over 24 days, across 96 agent sessions, roughly 80,000 tool calls and 256 prompts. The company stresses that subject-matter expertise steered the agents throughout. The result is a sign of how quickly complex enterprise chains can now be found, not evidence of fully autonomous exploitation.
Fixed Builds
- SharePoint Server Subscription Edition: KB5002893 (16.0.19725.20522).
- SharePoint Server 2019: KB5002894 and KB5002896 (16.0.10417.20198).
- SharePoint Enterprise Server 2016: KB5002905 and KB5002906 (16.0.5565.1001).
What To Verify First
- Confirm both the July update (for CVE-2026-55040) and the August update (for CVE-2026-63520) are installed on every farm server.
- Check build numbers against the list above rather than relying on deployment status.
- Review exposure of on-premises SharePoint to the internet and confirm AMSI integration is enabled.
What Teams May Be Underestimating
Teams that installed July’s update may feel covered. That fix blocks the authentication bypass, but the August RCE remains reachable to anyone who can authenticate. With exploitation of other SharePoint flaws ongoing this summer, delaying August updates for SharePoint is a real risk.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- Rapid7: Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability
- Rapid7: CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
