Full research report
Hackers target Microsoft SharePoint RCE chain with PoC exploit
Executive assessment
Two on-premises SharePoint flaws—a JWT authentication bypass (CVE-2026-55040, CVSS 9.1) and a Business Connectivity Services RCE via unsafe .NET type instantiation (CVE-2026-63520, CVSS 8.1)—were discovered by Rapid7's Stephen Fewer during Pwn2Own Berlin 2026 and patched by Microsoft in July and August 2026 respectively. Public PoC code for CVE-2026-55040 was weaponised within 24 hours of release on 11 August, prompting a CISA KEV addition on 18 August with a three-day remediation window for federal agencies. VulnCheck's Jonathan Peterson published a PoC for CVE-2026-63520 on 24 August—reportedly ahead of Rapid7's scheduled disclosure after a third party published technical details—and by 25 August, Defused honeypots recorded the complete two-stage chain being probed, with the JWT bypass exercised and BCS sinks actively enumerated. No successful code execution has yet been confirmed in the wild, but complete public exploit code for both stages of the chain is available and the approximately 8,700 internet-facing SharePoint servers tracked by Shadowserver represent a significant unmitigated exposure window for any organisation that has not applied the July and August 2026 Patch Tuesday updates.
What happened
Rapid7 researcher Stephen Fewer discovered a two-vulnerability chain in on-premises Microsoft SharePoint Server during Pwn2Own Berlin 2026 and disclosed it to Microsoft on 18 May 2026. CVE-2026-55040, a JWT authentication bypass, was patched in July 2026 and publicly detailed with a PoC on 11 August; exploitation was detected within 24 hours and CISA added it to the KEV catalogue on 18 August. CVE-2026-63520, a Business Connectivity Services RCE, was patched in August 2026 with an independent PoC published by VulnCheck on 24 August. By 25 August, Defused honeypots recorded the complete two-stage chain being actively probed, though no successful code execution has yet been confirmed in the wild.
Affected scope
SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 (all on-premises deployments). SharePoint Online is unaffected. Shadowserver identifies approximately 8,700 internet-exposed SharePoint instances globally; the proportion remaining unpatched is not publicly disclosed.
Technical assessment
CVE-2026-55040 exploits weaknesses in SharePoint's JWT token validation, enabling unauthenticated callers to forge tokens and impersonate site users or administrators by targeting Active Directory Security IDs or User Principal Names. CVE-2026-63520 then exploits unsafe .NET type instantiation within Business Connectivity Services, reachable once an attacker holds a valid-appearing identity. Chained, the pair yield unauthenticated remote code execution running as the Windows service account hosting the SharePoint site instance. Microsoft's August 2026 patch for CVE-2026-63520 introduced a ValidateSafeBcsType validation function to restrict which .NET types BCS models may instantiate.
Recommended defensive actions
- Apply July 2026 Patch Tuesday updates for CVE-2026-55040 immediately: KB5002882 (Subscription Edition), KB5002883 (2019), KB5002891 (Enterprise 2016)—patching this CVE alone breaks the complete unauthenticated RCE chain.
- Apply August 2026 patches for CVE-2026-63520: KB5002893 (Subscription Edition), KB5002894 and KB5002896 (2019), KB5002905 and KB5002906 (Enterprise 2016).
- Restrict internet exposure of on-premises SharePoint servers; place instances behind a WAF or VPN where operationally feasible to reduce the attack surface for unauthenticated exploitation.
- Monitor SharePoint access logs for anomalous or malformed JWT tokens, unexpected admin-level operations from unauthenticated sessions, unusual Business Data Connectivity Model uploads, and HTTP request signatures matching published PoC patterns.
- Verify patch application status across all on-premises SharePoint instances and prioritise internet-facing servers in line with CISA's three-day remediation deadline of 21 August 2026.
Uncertainties and evidence gaps
- No successful code execution via the chained exploit has been confirmed in the wild; available evidence is limited to honeypot probing data from Defused.
- No threat actor or campaign has been publicly attributed to the observed exploitation attempts.
- CVE-2026-63520 has not yet been added to the CISA KEV catalogue as of 26 August 2026; its real-world exploitation rate beyond honeypot activity remains unconfirmed.
- The exact number of unpatched internet-facing SharePoint servers within Shadowserver's count of approximately 8,700 is not publicly disclosed, making precise exposure scope uncertain.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
CVE-2026-55040 confirmed actively exploited (CISA KEV, 18 Aug 2026); CVE-2026-63520 chain probed in Defused honeypots as of 25 Aug 2026 with no confirmed successful code execution yet; public PoC exploit code available for both.
Investigation began with the supplied BleepingComputer article and CISA KEV entry, which established a confirmed exploitation timeline for CVE-2026-55040. Primary-source fetches of Rapid7 and VulnCheck publications confirmed both CVEs originate from Rapid7's Pwn2Own Berlin 2026 research, identified precise patch KB numbers for all affected SharePoint versions, and verified that VulnCheck independently published an RCE PoC on 24 August ahead of Rapid7's planned schedule. SecurityWeek provided a second independent outlet corroborating rapid weaponisation. CISA advisory pages returned HTTP 403 and could not be directly verified; KEV status for CVE-2026-55040 is accepted from the supplied source material and is consistent with multiple corroborating search results.
- What do primary sources confirm about the two SharePoint CVEs, their exploitation status, and the timeline?Fetched the BleepingComputer article supplied in the source material.bleepingcomputer.com ↗
Confirmed both CVEs, PoC researcher names and release dates, Defused honeypot chain probing on 25 Aug, approximately 8,700 exposed servers via Shadowserver, and CISA KEV addition of CVE-2026-55040 on 18 Aug with a three-day remediation deadline.
why Established the core event timeline and exploitation status from the primary reporting outlet used in the source material.
- Are there primary vendor or researcher sources for technical details and patch KB numbers?Searched for CVE-2026-55040 and CVE-2026-63520 to identify Rapid7 and VulnCheck primary publications.
Located Rapid7 blog posts for both CVEs and VulnCheck's technical analysis of CVE-2026-63520, all indexed publicly.
why Primary researcher sources reduce dependence on secondary reporting and supply authoritative patch KB numbers required for defensive actions.
- What are the precise technical details, affected versions, CVSS scores, and patch identifiers for CVE-2026-63520?Fetched Rapid7's ETR for CVE-2026-63520.rapid7.com ↗
CVSS 8.1, CWE-20, all supported on-premises SharePoint versions affected; patches KB5002893/94/96/905/906 released August 2026; vulnerability discovered at Pwn2Own Berlin 2026; third-party PoC publication on 24 Aug triggered early Rapid7 disclosure.
why Confirmed patch identifiers and severity rating directly from the discovering researcher, critical for defender prioritisation guidance.
- What does VulnCheck's independent analysis reveal about the RCE mechanism and exploit chain?Fetched VulnCheck's technical blog post on the exploit chain.vulncheck.com ↗
Confirmed forged JWT tokens are used to obtain a FormDigestValue; a crafted BDCM XML then triggers unsafe Activator.CreateInstance via System.Web.UI.LosFormatter, enabling deserialization-based code execution. Microsoft's patch introduced ValidateSafeBcsType to restrict permitted BCS types.
why Second independent technical source corroborating the exploitation mechanism from the PoC author, confirming the chain requires both CVEs and establishing the patch's defensive logic.
- What are the precise details, CVSS rating, and patch KB numbers for CVE-2026-55040?Fetched Rapid7's advisory for CVE-2026-55040.rapid7.com ↗
CVSS 9.1 Critical, CWE-1390; patches KB5002882/83/91 released July 2026; disclosed to Microsoft 18 May; publicly detailed 11 Aug; CISA KEV addition 18 Aug confirmed.
why Confirmed the KB numbers for the first-stage vulnerability, corroborated the KEV timeline from the source material, and established that patching this CVE alone breaks the full unauthenticated RCE chain.
- Is there independent corroboration from a second outlet of rapid weaponisation following PoC release?Fetched SecurityWeek's article on the exploitation timeline.securityweek.com ↗
Confirmed exploitation attempts detected within 24 hours of PoC publication on 11 August; no specific threat actor identified; broader context that four other SharePoint CVEs were also exploited during summer 2026.
why Provides a second independent source domain corroborating the rapid weaponisation finding, satisfying the minimum evidentiary threshold for high confidence.
- Can CISA's KEV catalogue entries for these CVEs be directly verified via fetch?Attempted to fetch the CISA KEV August 18 alert page and the KEV catalogue directly.
Both CISA URLs returned HTTP 403 Forbidden; content could not be retrieved or directly cited.
why KEV status for CVE-2026-55040 is accepted from the supplied source material (added 2026-08-18) and is consistently corroborated by Rapid7's advisory and multiple independent news outlets; CISA URLs are excluded from direct citations.
Research coverage
All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok10 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1682 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| Rapid7news | ok empty0 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. Supplied a PoC or technical exploit reference opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5333 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 2 opened outside the registered collection
Vulnerability & exploitation2
PoC & exploit code2
Rapid7's Stephen Fewer published technical details and PoC on 11 Aug 2026; weaponised within 24 hours of release.
VulnCheck's Jonathan Peterson published CVE-2026-63520 PoC on 24 Aug 2026, completing the publicly available unauthenticated RCE chain.
Vendor & gov advisories1
Vendor researcher advisory covering CVSS 8.1, affected SharePoint editions, and patch KB numbers.
Analysis & research2
Covers Defused honeypot observations, Shadowserver exposure data, and the exploitation timeline across both CVEs.
Independent corroboration of rapid weaponisation within 24 hours of the 11 Aug 2026 PoC publication.