Microsoft’s on-premises SharePoint deserialization problem has a new twist: a JWT authentication bypass that attackers have been exploiting in the wild since August 12 can now be chained with a second, freshly disclosed flaw in Business Connectivity Services to reach full unauthenticated remote code execution — no credentials required at any step.

What happened

CVE-2026-55040 is a critical (CVSS 9.1) authentication bypass in SharePoint’s JWT token validation pipeline, patched by Microsoft on July 14, 2026 as part of that month’s Patch Tuesday. Rapid7 published a working proof-of-concept on August 11, and exploitation followed almost immediately: threat-intel firm Defused reported attackers hitting SharePoint honeypots with the Rapid7 PoC within a day of release, and KEVIntel logged 12 exploitation attempts since mid-July, 8 of them concentrated on August 12–13 alone. Over 8,500 on-prem SharePoint servers remain internet-exposed.

Days later, Rapid7 and Microsoft jointly disclosed CVE-2026-63520 (CVSS 8.1), a second bug in the same product line that turns the auth bypass into code execution. The two flaws form a complete unauthenticated-to-RCE chain, publicly documented as CVE-2026-55040 → CVE-2026-63520.

Technical details

CVE-2026-55040 lives in SharePoint’s JWT validation code. Rapid7 identified four stacked weaknesses in the same code path: signature checking was effectively disabled, a certificate used to verify tokens was trusted without confirming it was genuine, and the final signature check only confirmed a value was present, not that it was correct. The practical result: an attacker who knows a target’s Active Directory username — no password, no prior access — can forge a JWT that SharePoint accepts as belonging to that user, including a site or farm administrator.

CVE-2026-63520 sits in Business Connectivity Services (BCS), which builds .NET objects from external input in an unsafe way. By supplying a specially crafted BCS payload, an attacker who already holds a forged administrator token — via CVE-2026-55040 — can trigger a malicious .NET gadget chain and execute arbitrary commands with the privileges of the SharePoint application pool account.

Chained together: forge an admin JWT with no credentials (CVE-2026-55040), then use that forged identity to trip the BCS gadget chain (CVE-2026-63520) for code execution. The result is unauthenticated RCE against any exposed farm running an unpatched combination of these two updates.

Affected products are Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 — the on-premises product line. SharePoint Online is not affected. Microsoft shipped fixes via KB5002882 (Subscription Edition), KB5002883 (2019), and KB5002891 (Enterprise 2016).

This is the fourth significant on-prem SharePoint RCE-class disclosure in 2026, following CVE-2026-20963 in March, CVE-2026-45659 in May, and the machine-key-theft campaign around CVE-2026-50522 in July — on-prem SharePoint’s deserialization and identity-validation code paths remain a recurring, not isolated, source of critical bugs.

Impact

Any internet-reachable on-prem SharePoint farm that hasn’t applied both the July and August updates should be treated as exposed to full unauthenticated compromise, not just authentication bypass. Given the active exploitation already underway against CVE-2026-55040 alone — before the BCS chain was even public — farms that are still unpatched should be assumed to be under active targeting. Successful chaining gives an attacker arbitrary code execution as the SharePoint service account, access to content databases and farm configuration secrets, and a foothold for lateral movement across any connected Microsoft 365 or Active Directory infrastructure the farm touches.

Mitigation

  • Apply both the July 14, 2026 Patch Tuesday update (fixes CVE-2026-55040) and the August update (fixes CVE-2026-63520) — patching only one leaves the chain partially viable or the JWT bypass itself still exploitable.
  • Confirm the correct KB is installed for your edition: KB5002882 (Subscription Edition), KB5002883 (Server 2019), KB5002891 (Enterprise 2016).
  • Review IIS and SharePoint ULS logs back to at least July 14 for anomalous authentication activity and forged-token indicators, and for unexpected BCS-related requests or dropped assemblies.
  • Where internet exposure isn’t operationally required, move on-prem SharePoint front ends behind an authenticated reverse proxy or VPN rather than exposing them directly.
  • Treat any farm showing signs of exploitation prior to patching as fully compromised: rotate service account credentials and machine keys, and invalidate existing sessions.

Track Microsoft’s Security Update Guide and CISA’s KEV catalog for confirmation of KEV listing, and monitor Rapid7’s advisories for further technical detail as the 30-day full-disclosure window closes.