Researchers Disclose AI-Assisted Share Point Exploit Chain Reaching Unauthenticated RCE
Summary: Researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, without a valid account, tracked as CVE-2026-55040 (CVSS 9.1) and affecting SharePoint Server Subscription Edition, 2019, and 2016. Rapid7 chained that bypass to a separate remote code execution flaw, CVE-2026-63520 (CVSS 8.1), disclosed August 11, and ran code on the server with no credentials, with the bypass sitting in SharePoint's JSON Web Token validation pipeline.
Why it matters: Microsoft shipped the July fix on July 14, the same day SharePoint Server 2016 and 2019 reached end of support, so whether the two versions on the affected list for the new RCE ever receive an August update is unresolved. CISA marked the bypass automatable with total technical impact, and three other SharePoint flaws were under active exploitation when its July 14 alert went out, with attackers stealing IIS machine keys.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-55040CVE-2026-63520
- Related
- CVE-2026-55040: Microsoft Share Point Weak Authentication Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026