Two SharePoint Bugs Now Chain to Full RCE

The chain, explained

CVE-2026-55040 is a JWT token validation bypass that lets a remote, unauthenticated attacker impersonate a SharePoint user or administrator. CVE-2026-63520 is a separate flaw in SharePoint's Business Connectivity Services, an unsafe .NET type instantiation that lets an attacker craft a custom object chain to execute arbitrary operating-system commands with the SharePoint service account's privileges. Neither flaw alone is catastrophic on its own terms, but Rapid7 researcher Stephen Fewer disclosed both to Microsoft as a single chain back in May, and together they add up to unauthenticated remote code execution against SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016.

Microsoft fixed the two halves on different schedules: CVE-2026-55040 shipped with the July 2026 Patch Tuesday round, and CVE-2026-63520 followed a month later on August 11, 2026, alongside knowledge-base updates KB5002893, KB5002894, KB5002896, KB5002905 and KB5002906 covering the different affected product editions. Rapid7 says there is no confirmed in-the-wild exploitation of the full RCE chain yet, since the disclosure was coordinated. The first half, though, is a different story.

Why splitting the patch across two months matters

Rapid7 published a detailed technical writeup and proof-of-concept for CVE-2026-55040, and threat-intelligence firm Defused says its SharePoint honeypots have already recorded real attackers using that public proof-of-concept to bypass authentication, days after it went live. Microsoft has not yet confirmed in-the-wild exploitation itself, but an independent detection network catching live attempts is a strong signal that opportunistic scanning has already started.

The uncomfortable part is the calendar. Because the two halves of the chain were patched a month apart, an organization that dutifully applied July's fix has spent the past several weeks believing the authentication-bypass issue was closed, while the second, RCE-completing half sat unpatched until August 11. Anyone who has not yet applied both August's KB updates and July's fix together is currently running a documented, publicly demonstrated path to unauthenticated code execution on their SharePoint server -- not a theoretical one.

What to check on your own SharePoint estate

This is squarely an on-premises problem: SharePoint Online is not affected, but SharePoint Server 2016, 2019 and Subscription Edition installations are common across European and UK public-sector bodies, universities and mid-sized enterprises that never migrated fully to the cloud. The practical checklist is to confirm both KB updates from July and August are installed together, not just one of them, since a partial patch leaves the chain intact.

CISA's standing advice is also worth acting on regardless of patch status: do not expose an on-premises SharePoint server directly to the internet, and where it must be reachable, put it behind a Layer 7 reverse proxy or equivalent application-layer control that can filter the kind of crafted requests this chain relies on. Given that a working, public proof-of-concept already exists for half the chain, treat this as an active incident-response item this week, not a routine patch-cycle line item.

Read next: The SharePoint Patch You Skipped in May Is Now Urgent  |  Gunra Ransomware Runs on Fortinet Bugs Patched in 2025