1. Executive summary
Rapid7 and Microsoft have disclosed CVE-2026-63520, a high-severity (CVSS 8.1) remote code execution vulnerability in Microsoft SharePoint Business Connectivity Services caused by unsafe .NET type instantiation. The flaw affects all supported SharePoint Server versions, plus certain Project Server and Office Web Apps Server editions. When chained with the authentication bypass CVE-2026-55040 (CVSS 9.1, patched July 2026), the two form a critical unauthenticated RCE exploit chain against internet-facing SharePoint deployments. Neither CVE is currently listed in CISA KEV, and no in-the-wild exploitation of this specific chain has been reported. EMEA financial services running on-premise SharePoint should treat patching as urgent given SharePoint's role as a repository for sensitive business data and its integration with Active Directory.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | A patched unauthenticated RCE chain exists for a critical on-premise collaboration platform; clients must verify remediation through authenticated vulnerability scanning. | Run authenticated checks (Rapid7 InsightVM/Nexpose August 12 content release for CVE-2026-63520; July 15 release for CVE-2026-55040) to confirm patch coverage across all SharePoint, Project Server, and Office Web Apps instances. |
| DORA Art. 28: ICT third-party risk — general principles | Microsoft SharePoint Server is an on-premise ICT service maintained under vendor patch cycles; the exploit chain was split across two monthly patch cycles (July and August 2026). | Confirm that third-party/vendor patch SLAs for on-premise Microsoft infrastructure cover both links in the chain and that no instance remains partially patched (July patch applied but August pending, or vice versa). |
3. Technical analysis & attack chain
Confirmed exploit chain (CVE-2026-55040 → CVE-2026-63520)
- Reconnaissance — SID/UPN enumeration. The attacker enumerates potential SharePoint users via Active Directory Security Identifier (SID) or User Principal Name (UPN) discovery. The UPN follows an email-like format (e.g.,
administrator@domain.local). The attacker must know in advance which user they wish to impersonate; the SharePoint site administrator account is the high-value target. - Authentication bypass — CVE-2026-55040. The attacker exploits flaws in the SharePoint JWT token validation pipeline to bypass authentication and assume the identity of the targeted user — including the site administrator — without valid credentials. This vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. CVSS 9.1 (Critical), CWE-1390. Patched in Microsoft's July 2026 update cycle.
- Remote code execution — CVE-2026-63520. With authenticated access to the SharePoint site (obtained via step 2 or via legitimate credentials), the attacker exploits an unsafe .NET type instantiation issue within SharePoint's Business Connectivity Services. By crafting a custom .NET gadget chain, the attacker achieves arbitrary code execution on the server, including the ability to execute attacker-controlled OS commands. Code runs with the privileges of the Windows service account running the SharePoint Site instance. CVSS 8.1 (High), CWE-20 (Improper Input Validation). Patched in Microsoft's August 2026 update cycle.
Affected products (CVE-2026-63520)
- Microsoft SharePoint Server Subscription Edition
- SharePoint Server Subscription Edition Language Pack
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
- Microsoft Project Server 2013 Service Pack 1 (64-bit edition)
- Microsoft Office Web Apps 2013 Service Pack 1
Affected products (CVE-2026-55040)
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016
Key technical notes
- The RCE component (CVE-2026-63520) affects a broader product set than the authentication bypass (CVE-2026-55040), which is limited to SharePoint Server only. Project Server and Office Web Apps Server are exposed to the RCE independently if an attacker already holds authenticated access.
- The exploit chain was developed using AI-assisted vulnerability research: publicly available LLMs, guided by a subject matter expert, over 120 hours of agent runtime across 24 days, 96 sessions, ~80,000 agentic tool calls, and 256 prompts. Rapid7 reports that current frontier models have significantly increased capabilities since the Q1 2026 research sprint.
- Rapid7 will publish full technical details for CVE-2026-63520 within 30 days of this disclosure (i.e., by approximately September 10, 2026). No proof-of-concept code has been publicly released as of this advisory.
CVSS discrepancy note: The VERIFIED REFERENCE DATA records CVE-2026-55040 at CVSS 9.1 (Critical). The Rapid7 disclosure blog for CVE-2026-55040 states Microsoft assigned it CVSSv3.1 5.3 (Medium). We use the verified 9.1 value; the discrepancy likely reflects a difference between Microsoft's initial scoring and the NVD-published score. Both assessments agree the vulnerability is an authentication bypass in the JWT token validation pipeline (CWE-1390).
Attribution: No threat actor attribution is claimed. The vulnerabilities were discovered by Stephen Fewer (Senior Principal Security Researcher, Rapid7 Labs) during a research project. No MITRE ATT&CK actor profile is associated. No in-the-wild exploitation has been reported for either CVE-2026-63520 or CVE-2026-55040. This is corroborated across Rapid7 and The Hacker News reporting.
4. Mitigation & containment
P1 — Within 24 hours
- Apply the August 2026 Microsoft security updates to all SharePoint Server, Project Server, and Office Web Apps Server instances. This patches CVE-2026-63520.
- Verify that the July 2026 Microsoft security updates were already applied to all SharePoint Server instances (Subscription Edition, 2019, 2016). This patches CVE-2026-55040 and breaks the unauthenticated RCE chain. Any instance missing either patch remains vulnerable to the full chain.
- Inventory all internet-facing SharePoint Server endpoints. If patching cannot be completed immediately, restrict external access (WAF rules, reverse proxy ACLs, or temporary VPN-only access) to reduce exposure to unauthenticated attacks.
P2 — Within 72 hours
- Run authenticated vulnerability scans against all SharePoint, Project Server, and Office Web Apps Server deployments to confirm patch coverage. Rapid7 InsightVM/Nexpose checks for CVE-2026-63520 are available in the August 12 content release; checks for CVE-2026-55040 are in the July 15 content release.
- Identify and document the Windows service account running each SharePoint Site instance. In the event of prior compromise, this account's credentials and permissions should be treated as potentially exposed.
- Review IIS logs and SharePoint audit logs for anomalous authentication events or unexpected Business Connectivity Services activity, particularly between May 18, 2026 (disclosure to Microsoft) and the patch date. Focus on requests targeting BCS endpoints from untrusted source IPs.
P3 — Within 7 days
- Validate that SharePoint Server Subscription Edition Language Pack deployments received the August update (these are separately listed as affected and may be missed in standard patch workflows).
- Review whether any legacy Project Server 2013 SP1 or Office Web Apps 2013 SP1 deployments exist in the estate — these are end-of-mainstream-support products and may require extended security update agreements. If present, assess whether they can be decommissioned or isolated.
- Monitor for Rapid7's full technical details publication (~September 10, 2026) and update detection rules accordingly.
5. Indicators of compromise
No indicators of compromise available in the source material. No proof-of-concept code has been published, and no in-the-wild exploitation has been observed for this exploit chain.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unauthenticated requests to SharePoint JWT authentication endpoints resulting in successful session establishment | SharePoint IIS logs; authentication audit logs | Medium — derived from vulnerability mechanism, not observed exploitation |
| SID enumeration or UPN enumeration queries against Active Directory originating from SharePoint server or external IPs | AD event logs (Event ID 4662, 4778); network monitoring | Medium — prerequisite step in the documented exploit chain |
| Unexpected .NET type instantiation or deserialization activity within SharePoint Business Connectivity Services | SharePoint ULS logs; .NET CLR ETW tracing; EDR process telemetry on w3wp.exe | Medium — derived from vulnerability mechanism |
| OS command execution originating from the SharePoint application pool worker process (w3wp.exe) running under the SharePoint service account context | EDR; Sysmon Event ID 1 (Process Create); Windows Security Event ID 4688 | High — direct consequence of successful RCE |
6. Detection
Insufficient indicators to author detection rules. The source material describes the vulnerability mechanism (unsafe .NET type instantiation in Business Connectivity Services, JWT token validation bypass) but does not provide specific artefacts such as file names, registry keys, mutex names, command-line strings, or network signatures that would constitute threat artefacts for YARA or Sigma rules. Rapid7 has stated that full technical details will be published within 30 days; detection rules should be authored at that time.
CVE assessment
2 referenced CVEs — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-55040 | 9.1 Critical | — | 2% | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-63520 | 8.1 High | — | — | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
7. Sources
- Rapid7 — CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED) — https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed — 2026-08-11
- Rapid7 — CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED) — https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed — 2026-07
- The Hacker News — Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE — https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html — 2026-08
8. Adverse Trace position
CVE-2026-63520 is a confirmed high-severity RCE (CVSS 8.1, CWE-20) in a ubiquitous enterprise platform, and when chained with the already-patched CVE-2026-55040 (CVSS 9.1, CWE-1390), the combined impact is critical: unauthenticated remote code execution against any unpatched SharePoint Server. Neither CVE is in CISA KEV and no in-the-wild exploitation has been observed, but the 30-day window before full technical details and potential PoC publication creates a narrow remediation runway. EMEA financial services with on-premise SharePoint deployments — particularly internet-facing instances — should apply the August 2026 patches immediately and confirm July 2026 patches are in place. The AI-assisted research methodology used to discover this chain is notable: it signals that the rate of discovery for complex proprietary-target vulnerabilities is accelerating, which may compress the typical window between disclosure and exploitation for future CVEs. We will monitor for PoC publication, any KEV additions, and emergence of exploitation signals, and will update clients accordingly.
Published via PulseTrace — Adverse Trace threat intelligence.