Full Report
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. [...]
Analysis Summary
# Vulnerability: Microsoft SharePoint RCE Chain (CVE-2026-55040 & CVE-2026-63520)
## CVE Details
- **CVE ID:** CVE-2026-55040 (Auth Bypass) and CVE-2026-63520 (RCE)
- **CVSS Score:**
- CVE-2026-55040: Not explicitly listed in text (Historically high for auth bypass)
- CVE-2026-63520: Not explicitly listed in text (Ranked as "Attractive target")
- **CWE:**
- CVE-2026-55040: Improper JWT Token Validation
- CVE-2026-63520: Unsafe Deserialization/Type Handling in Business Connectivity Services (BCS)
## Affected Systems
- **Products:** Microsoft SharePoint Server
- **Versions:** On-premises SharePoint Server instances (Specific version numbers not provided in article; refer to Microsoft advisory)
- **Configurations:** Systems with Business Connectivity Services (BCS) enabled and those exposed directly to the internet.
## Vulnerability Description
This attack involves a two-stage exploit chain:
1. **CVE-2026-55040:** An authentication bypass vulnerability located in the JWT (JSON Web Token) validation pipeline. It allows an unprivileged attacker to bypass security checks and act as a SharePoint site user or administrator.
2. **CVE-2026-63520:** A vulnerability within the Business Data Catalog (BDC) / Business Connectivity Services (BCS). Once administrative access is gained via the first flaw, the attacker can leverage this second flaw to execute arbitrary code on the underlying server.
## Exploitation
- **Status:** Exploited in the wild (chained attacks observed in honeypots); PoC available for both vulnerabilities.
- **Complexity:** Medium (Requires chaining two distinct flaws).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Full access to SharePoint data and server files).
- **Integrity:** Total (Arbitrary code execution allowed).
- **Availability:** Total (Potential for server takeover or ransomware deployment).
## Remediation
### Patches
- Microsoft has released security updates for both vulnerabilities. Administrators should update SharePoint Server to the latest patch levels immediately.
### Workarounds
- **Network Isolation:** Avoid exposing SharePoint servers directly to the internet; use VPNs or Zero Trust Gateways.
- **Hardening:** Follow Microsoft’s official SharePoint Server security-hardening guidance.
- **Disable Services:** If not required, disable Business Connectivity Services (BCS).
## Detection
- **Indicators of Compromise:**
- Unusual administrative enumeration activity.
- Probing of the Business Data Catalog (BDC) endpoints.
- Presence of unauthorized JWT tokens in logs.
- **Detection methods and tools:**
- Monitor web server logs for exploitation attempts targeting the JWT validation pipeline.
- Use CISA’s Known Exploited Vulnerabilities (KEV) catalog to track related SharePoint threats.
## References
- **Vendor Advisories:** hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-63520
- **Threat Intelligence:** hxxps[://]www[.]rapid7[.]com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- **Original Report:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/