Attackers have begun testing a chain of two vulnerabilities in Microsoft SharePoint that could give them the ability to execute code remotely on unsecured servers, according to threat intelligence company Defused. This follows the release of proof-of-concept (PoC) exploits for the vulnerabilities, which lowered the technical threshold required for exploitation attempts.
How Does the Chain Work?
The first vulnerability, CVE-2026-55040, is an authentication-bypass flaw in SharePoint’s JWT token validation path. An attacker without privileges can exploit it to perform operations as a user or administrator on a SharePoint site.
The second vulnerability, CVE-2026-63520, exists in the Business Connectivity Services (BCS). After successfully exploiting the authentication-bypass vulnerability, the attacker can use the second vulnerability to execute code remotely on the targeted SharePoint server.
Security researcher Stephen Fewer of Rapid7 published the proof of concept for the first part of the chain on August 11, while researcher Jonathan Peterson of VulnCheck published the exploit for the second vulnerability on August 24. One day after the PoC for CVE-2026-55040 was published, Defused said the code had already been used in attacks.
What Has Been Observed So Far?
On August 25, Defused reported that it had detected attempts in its honeypots combining the two vulnerabilities. The indicators included the use of JWT bypass, followed by intensive operations to enumerate administrator accounts and scan the Business Data Catalog associated with the second vulnerability. However, the company said it had not observed code execution by the time it issued its warning.
The nonprofit cybersecurity organization Shadowserver tracks more than 8,700 exposed Microsoft SharePoint servers on the internet. The available data does not indicate how many of these systems are honeypots or how many servers have already been secured.
Warnings from Security Authorities
On August 18, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies and network defenders to secure SharePoint servers against ongoing attacks exploiting CVE-2026-55040. On July 15, the agency also warned of the exploitation of three other vulnerabilities—CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—against internet-exposed on-premises SharePoint Server installations.
CISA also confirmed that the remote code execution vulnerability CVE-2026-45659, which has been known since early July to be actively exploited, is now being used in attacks linked to ransomware. Since November 2021, the agency has listed 15 actively exploited vulnerabilities in Microsoft SharePoint, eight of which were also linked to ransomware gangs.
Why Does This Matter?
The significance of the development is that the chain does not rely solely on a single remote code execution vulnerability; it begins with an authentication bypass and then moves to a component that provides an execution path. In practice, this means that administrators of exposed servers need to address both vulnerabilities together and review login attempts, administrator-account enumeration, and Business Data Catalog activity.
CISA recommends that security teams review Microsoft’s official guidance for hardening SharePoint and avoid exposing SharePoint servers directly to the internet unless necessary. Some questions remain unresolved: Microsoft classified CVE-2026-63520 as an attractive target for attackers, but has not yet classified it as actively exploited, and Defused has not observed command execution in its honeypots so far.