This is now a real exploit chain story, not a vague warning about SharePoint risk. Defenders are dealing with a two-step path that begins with authentication bypass and ends with server-side code execution on unpatched on-premises systems.
The useful move is to separate the components and the timeline, because the speed from PoC release to weaponized use is the part that should change patch urgency and exposure review.
The Two Vulnerabilities In The Chain
BleepingComputer says the first issue is CVE-2026-55040, an authentication bypass in SharePoint's JWT token validation pipeline. Attackers without privileges can use it to perform actions as a SharePoint site user or administrator.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
The second is CVE-2026-63520, a flaw in SharePoint's Business Connectivity Services that can be chained after CVE-2026-55040 to reach remote code execution on a targeted SharePoint Server.
Why The PoC Timeline Matters
Rapid7 researcher Stephen Fewer released proof-of-concept code for CVE-2026-55040 on August 11. VulnCheck researcher Jonathan Peterson followed on August 24 with PoC code for CVE-2026-63520.
That would already be enough to justify urgency, but the more important detail is that Defused reported the first PoC had been weaponized one day after publication. By August 25, the company said attackers were chaining the auth bypass and the RCE flaw together in the wild.
Why This Is More Than A Patch Story
SharePoint tends to sit close to document access, identity trust, internal workflows, and collaboration data. Once attackers can mint privileged actions through the JWT validation path and then pivot into code execution, the cleanup burden can extend well beyond the server itself.
The question is not only whether July's fixes were available. It is whether every reachable SharePoint instance was actually updated, whether external exposure was reduced, and whether anyone verified for signs that access occurred before patching.
The Wider Context Around SharePoint
CISA had already ordered federal agencies and network defenders to secure SharePoint servers against ongoing CVE-2026-55040 attacks. The agency also urged defenders not to expose SharePoint directly to the internet unless truly necessary.
BleepingComputer notes that CISA has flagged 15 actively exploited SharePoint vulnerabilities since late 2021, and eight of them were also exploited by ransomware gangs. That matters because it shows SharePoint is not just a one-off patch headache. It is a recurring attacker target where slow cleanup tends to get punished.
What Teams Should Do Next
Treat this as exposure validation plus compromise review.
- Inventory every on-premises SharePoint deployment and identify any instance still reachable from the internet or weakly segmented from untrusted paths.
- Verify that fixes for CVE-2026-55040 and CVE-2026-63520 actually landed everywhere, not just on the best-known production clusters.
- Review logs and administrative activity for signs of unexpected token abuse, privilege changes, suspicious Business Connectivity Services activity, or post-exploitation access.
- Revisit Microsoft's hardening guidance and remove direct internet exposure where the business case is weak or outdated.
- Brief document-platform, identity, and incident-response owners together because this is both a server problem and a trust-boundary problem.
What Teams May Be Underestimating
The tempting mistake is to read this as just another Microsoft patch issue. The real operational risk is that SharePoint often inherits trust from the rest of the environment.
If defenders cannot answer quickly which instances are internet reachable, who owns them, and what data or workflows depend on them, then the delay problem becomes larger than the CVE list.
Source Context
CyberExperts used BleepingComputer as the primary source for this article and preserved the details that make the story useful: CVE-2026-55040, CVE-2026-63520, the Rapid7 and VulnCheck PoC releases, Defused's weaponization reporting, and CISA's broader warning against exposed SharePoint infrastructure.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
