Full Report
Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent. The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's
Analysis Summary
This summary is based on the provided article regarding the AI-assisted discovery of a critical exploit chain in Microsoft SharePoint.
# Vulnerability: Unauthenticated SharePoint Exploit Chain (JWT Bypass & RCE)
## CVE Details
- **CVE ID:** CVE-2026-55040 (Authentication Bypass); CVE-2026-63520 (Remote Code Execution)
- **CVSS Score:** 9.1 (Critical) for CVE-2026-55040; 8.1 (High) for CVE-2026-63520
- **CWE:** Not explicitly stated (Technical details suggest CWE-287: Improper Authentication and CWE-502: Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Microsoft SharePoint Server
- **Versions:**
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
- Project Server 2013 Service Pack 1 (Affected by RCE)
- Office Web Apps 2013 Service Pack 1 (Affected by RCE)
- **Configurations:** On-premises installations (SharePoint Online is notably **not** affected).
## Vulnerability Description
The exploit utilizes a two-step chain. The first flaw (CVE-2026-55040) resides in SharePoint's **JSON Web Token (JWT) validation pipeline**. This allows an unauthenticated attacker to bypass authentication and assume the identity of a specific user (such as an administrator). The second flaw (CVE-2026-63520) involves an **unsafe .NET type instantiation** within the Business Connectivity Services, which allows the attacker to execute arbitrary code once they have assumed a user identity.
## Exploitation
- **Status:** Proof-of-Concept (PoC) available; researchers demonstrated a successful unauthenticated RCE chain.
- **Complexity:** Low (CISA notes the attack is automatable).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Attacker can access data as any user/administrator)
- **Integrity:** Total (Attacker can execute code and modify system files)
- **Availability:** Total (Potential for full system takeover or service disruption)
## Remediation
### Patches
Microsoft released updates in July 2026 that reportedly break the exploit chain:
- **Subscription Edition:** KB5002882 (Build 16.0.19725.20434)
- **SharePoint Server 2019:** KB5002883 (Build 16.0.10417.20175)
- **SharePoint Server 2016:** KB5002891 (Build 16.0.5561.1001)
*Note: SharePoint 2016 and 2019 reached end-of-support on July 14, 2026. Future vulnerabilities may not receive patches for these versions.*
### Workarounds
The article does not list specific configuration workarounds; applying the July 2026 (or later) cumulative updates is the primary recommended mitigation.
## Detection
- **Indicators of Compromise:** Large volumes of queries to Domain Controllers for SID enumeration or UPN lookups.
- **Detection Methods:** Monitor SharePoint logs for unusual JWT validation errors or unexpected activity from the Business Connectivity Services (BCS).
## References
- **Microsoft SharePoint Update History:** hxxps[://]learn[.]microsoft[.]com/en-us/officeupdates/sharepoint-updates
- **Rapid7 Technical Analysis:** hxxps[://]www[.]rapid7[.]com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- **NVD Entry (CVE-2026-55040):** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-55040