SharePoint Authentication Bypass and RCE Chain Attack Observed: CVE-2026-55040 / CVE-2026-63520

1. Basic Information

• Article Title: Hackers target Microsoft SharePoint RCE chain with PoC exploit
• Publisher: BleepingComputer
• Publication Date: 2026-08-26
• Original Source: BleepingComputer
• Related Sources: Rapid7 analysis of CVE-2026-55040, VulnCheck analysis of CVE-2026-63520, Microsoft CVE-2026-63520 advisory
• Related Malware, Threat Actors, CVEs, and Products: CVE-2026-55040, CVE-2026-63520, Microsoft SharePoint Server
• Severity: High

2. Executive Summary

Attackers bypass SharePoint JWT authentication, enumerate management functions, and search for Business Data Catalog RCE sinks. However, successful code execution has not been confirmed at the time of observation.

3. Attack Flow

Attempted Chain from Authentication Bypass to BCS RCE Sink

1. An unauthenticated attacker exploits the JWT token validation flaw in CVE-2026-55040 to act as a SharePoint site user or administrator.
2. The attacker enumerates many management functions after bypassing authentication.
3. The attacker searches for the CVE-2026-63520 sink in Business Connectivity Services / Business Data Catalog.
4. Honeypots observed the JWT bypass, enumeration, and probing, but did not observe code execution.

4. Attacker Position and Execution Point

• Unauthenticated attackers reaching internet-exposed SharePoint servers.
• After successful CVE-2026-55040 exploitation, attackers can potentially perform API operations equivalent to a SharePoint user or administrator.

5. Visibility for Victims and Administrators

Victims

• No user interaction is required, and the attack is hard to notice from regular SharePoint screens.

Administrators

• The attack may appear as abnormal JWTs, management API enumeration from unauthenticated sources, and continuous probes to the Business Data Catalog.
• When RCE succeeds, it progresses to abnormal child processes or file changes under SharePoint / IIS workers.

6. Success and Failure Conditions

Success Conditions

• On-premises SharePoint servers vulnerable to both CVE-2026-55040 and CVE-2026-63520.
• Network access from the attacker to the target.
• Reaching BCS / BDC functions after bypassing authentication.

Failure Conditions / Risk Mitigation

• Apply the relevant Microsoft security updates.
• Stop direct internet exposure and restrict management surfaces and BCS.
• Block management operations after authentication bypass using applications, WAFs, or network controls.

7. What Happens on Success

• SharePoint user or administrator operations through authentication bypass.
• Arbitrary code execution on the SharePoint server if the chain succeeds.
• Subsequent access to documents, credentials, and internal connections. (The latter two depend on a successful chain and are not confirmed facts from the recent honeypot observation).

8. Observable Logs

• Email: Not directly related.
• Proxy/SWG/DNS: SharePoint requests with abnormal JWTs, management endpoint enumeration, and Business Data Catalog requests.
• Endpoint/EDR: Shells, PowerShell, cmd, script engines, and file writes under IIS / SharePoint processes upon successful RCE. (Not confirmed in current observations).
• Identity/IdP: SharePoint privileged operations occurring without corresponding regular logins.
• SaaS/Cloud: SharePoint audits, site collection / administrator operations, and document access.
• Network: Concentrated probes from the internet to SharePoint and server-origin egress expected after success.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Chain probes for CVE-2026-55040 and CVE-2026-63520 were observed in honeypots. RCE success is unconfirmed.
• Malware Execution or Authentication Success Confirmed: Application telemetry confirms that JWT bypass executed and led to management enumeration without authentication. This does not mean RCE was successful.
• Initial Execution Confirmed: Host telemetry confirms arbitrary code execution under SharePoint / IIS workers. This stage is not confirmed in public observations.

10. Investigation Playbook

• Trigger: Detect probes for CVE-2026-55040 / CVE-2026-63520, abnormal JWTs, and unauthenticated management enumeration.
• Initial Verification: Check SharePoint version, security updates, internet exposure, and BCS / BDC usage. Align web / IIS / SharePoint audits and EDR process telemetry on the same timeline.
• Endpoints: Check child processes like w3wp, PowerShell / cmd, web shells, file writes, scheduled tasks, and service changes.
• Authentication / Cloud: Match request subjects with Entra / AD logins to check for privileged operations without corresponding logins.
• Subsequent Operations: Check document access, credential access, service account usage, lateral movement, and external transmissions.
• Containment: Apply the relevant updates and restrict unnecessary internet exposure and BCS functions. Isolate hosts and rotate SharePoint / IIS / service account credentials when RCE is confirmed.
• Classification: Record probes, successful JWT bypasses, management enumeration, RCE, and subsequent compromises in separate stages.

11. Defense and Detection Ideas

• Single Events: Detect SharePoint management operations without corresponding logins, abnormal JWTs, and massive management endpoint enumeration in a short time.
• Timeline Correlation: Correlate potential JWT bypasses -> management enumeration -> BDC probes -> IIS child processes / file writes.
• Hunting: Inventory internet-exposed SharePoint servers, BCS usage, and patch statuses for CVE-2026-55040 / 63520.
• Log Gaps: Reverse proxies alone cannot confirm successful JWT bypasses or RCE. SharePoint audits and host process telemetry are required.
• Priority Actions: Apply security updates for both CVEs. Stop direct internet exposure of SharePoint or restrict source connections. Maintain IIS / SharePoint audits and EDR coverage.

12. Facts / Inference / Hypothesis

Facts

• A PoC for CVE-2026-55040 was released on August 11, 2026, and a PoC for CVE-2026-63520 was released on August 24.
• Defused honeypots observed JWT bypasses, management enumeration, and BDC sink probing for CVE-2026-63520 on August 25.
• Code execution has not been confirmed at the time of observation.
• Microsoft labeled CVE-2026-63520 as an attractive target, but did not list it as actively exploited at the time of the article.
• Shadowserver tracks over 8,700 internet-exposed SharePoint servers, which does not mean they are all vulnerable or compromised.

Inference

• Scans attempting the subsequent RCE chain are likely to increase due to the public PoC and observed authentication bypasses.
• Equating a successful authentication bypass with a successful RCE will lead to incorrect incident severity and response decisions.

Hypothesis

• The relationship between the honeypot probe sources and past real-world SharePoint exploitation campaigns is unclear.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): Attempting authentication bypass and RCE chains on internet-exposed SharePoint servers.

14. Unknowns and Further Investigation

• Actual successful code execution via CVE-2026-63520, victim organizations, attackers, and payloads.
• The percentage of vulnerable servers among the over 8,700 exposed servers.

15. Impact on Global Environments and SOCs

Organizations exposing on-premises SharePoint should prioritize patching both CVEs as a chain rather than treating them separately. Security Operations Centers (SOCs) must separate JWT bypass success, management enumeration, and RCE into distinct stages, and avoid confirming a compromise based on probes alone.

16. Summary by Role

• For SOCs: Correlate JWT bypasses -> management enumeration -> BDC probes -> host execution, and separate observed attack attempts from unconfirmed RCE.
• For Administrators: Patch both CVEs, stop direct internet exposure of SharePoint, and restrict unnecessary BCS and management surfaces.
• For Users: Because servers are targeted without user interaction, administrators must apply updates and review exposure scopes.