Microsoft SharePoint Flaws Let Unauthenticated Attackers Execute Remote Code

Microsoft SharePoint Server administrators are being urged to patch two vulnerabilities that could be combined to allow unauthenticated remote code execution on exposed on-premises servers.

The flaws, tracked as CVE-2026-55040 and CVE-2026-63520, affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Microsoft SharePoint Flaws

The urgency has increased after Defused reported observing probes targeting the complete exploit chain within its honeypot infrastructure.

The security firm noted that attackers exploited the JWT authentication bypass in CVE-2026-55040, followed by thorough enumeration of administrator accounts and probing of the Business Data Catalog attack surface associated with CVE-2026-63520.

Although Defused stated it has not yet seen successful code execution from these attacks, the sequence of events indicates that attackers are actively testing internet-exposed SharePoint servers for a way to achieve full compromise.

This activity followed VulnCheck’s publication of a detailed chain demonstrating how the two vulnerabilities can be combined.

CVE-2026-55040 is a critical authentication bypass vulnerability with a CVSS v3.1 score of 9.1. It exists in SharePoint Server’s JSON Web Token handler. It is determined by security settings, including RequireSignedTokens, which are disabled by default.

A remote attacker who knows a target user’s security identifier (SID) or user principal name (UPN) can create a forged JWT, bypassing SharePoint’s token validation checks. This allows the attacker to impersonate the selected user, even a privileged administrator, without possessing legitimate credentials.

CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, confirming active exploitation. Recent honeypot activity suggests that adversaries are now also assessing vulnerable environments for the publicly documented remote code execution chain.

CVE-2026-63520, rated 8.1 under CVSS v3.1, affects SharePoint’s Business Connectivity Services (BCS). BCS is designed to enable SharePoint applications to connect with external business data.

The component is meant to restrict object creation to classes explicitly permitted through the BCSAllowedTypeNames allow list. However, before Microsoft issued a patch, an attacker could provide an arbitrary class name in a malicious Business Data Connectivity model.

VulnCheck discovered that invoking System.Web.UI.LosFormatter could instantiate a deserialization gadget, ultimately allowing the execution of arbitrary code on the server.

In a successful attack chain, CVE-2026-55040 provides the initial authentication bypass and privilege-impersonation capabilities. The attacker can then access the vulnerable BCS functionality and exploit CVE-2026-63520 to achieve code execution. Organizations should not view these flaws as separate patching issues.

Microsoft has released updates for all affected SharePoint Server versions, while SharePoint Online is not affected. Censys identified approximately 329,000 SharePoint instances as of August 25, including about 21,000 on-premises systems that expose version information.

Administrators should immediately install patches for both CVEs, restrict public exposure wherever possible, review SharePoint authentication activity for forged token indicators, and investigate any unusual administrator enumeration or Business Data Catalog requests.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC