Attackers probe SharePoint auth-bypass and RCE chain days after public PoC release

Attackers are working to chain two recent SharePoint Server vulnerabilities into a single pre-authentication attack path, according to BleepingComputer. Honeypots have already captured the opening stages — a JWT authentication bypass, followed by enumeration of management functions and probing for a code-execution sink — but no successful code execution has been confirmed.

How the chain works

The chain begins with CVE-2026-55040, a flaw in how SharePoint validates JWT tokens. According to a technical summary of the report circulated on dev.to, an unauthenticated attacker who exploits it can act as a SharePoint site user or administrator and carry out API operations with that privilege. From there, the attacker enumerates management functions across the server and hunts for the second flaw, CVE-2026-63520, a code-execution sink in Business Connectivity Services and its Business Data Catalog component.

If both links hold, the attacker reaches arbitrary code execution on the server, which would open a path to documents, credentials and internal connections. Those downstream effects depend on the entire chain succeeding, and the final stage has not been observed in public telemetry.

What the honeypots recorded

Proof-of-concept code for CVE-2026-55040 was published on August 11, 2026, and a PoC for CVE-2026-63520 followed on August 24. One day later, on August 25, honeypots run by Defused recorded JWT bypasses, management enumeration and probing aimed at the Business Data Catalog sink. Application telemetry confirmed the JWT bypass executed and enabled management operations without authentication, but host telemetry has not shown code execution under SharePoint or IIS worker processes.

Microsoft has described CVE-2026-63520 as an attractive target for attackers, but at the time of the report it was not listed as actively exploited. Shadowserver, meanwhile, tracks more than 8,700 SharePoint servers exposed to the internet — a measure of attack surface that says nothing about whether those servers are patched or already compromised. The report also draws on Rapid7's analysis of CVE-2026-55040, VulnCheck's analysis of CVE-2026-63520 and Microsoft's advisory for the latter.

Detection and mitigation

The priority actions are to apply Microsoft's security updates for both CVEs, stop exposing SharePoint servers directly to the internet or restrict which sources can reach them, and limit management surfaces and Business Connectivity Services where they are not needed. Because the attack requires no user interaction and is hard to notice from regular SharePoint screens, administrators have to rely on logs.

Detection signals include abnormal JWTs, bursts of management endpoint enumeration from unauthenticated sources, sustained requests to Business Data Catalog endpoints, and privileged SharePoint operations with no corresponding Entra ID or Active Directory logins. If execution does succeed, expect anomalous child processes — shells, PowerShell, cmd or script engines — and file writes under IIS and SharePoint workers such as w3wp.

The analysis adds a caveat: reverse proxy logs alone cannot confirm a JWT bypass or code execution, so SharePoint audit logs and endpoint telemetry are required. Security teams are advised to classify each stage separately — probe, successful bypass, management enumeration, execution — because equating an authentication bypass with a successful RCE leads to incorrect severity and response decisions.

Why it matters

Individually, each flaw is serious; together they approximate a pre-authentication remote code execution path against unpatched, internet-facing servers. With both PoCs public and scanning observed within a day of the second release, attempts are expected to increase. Organizations running on-premises SharePoint should patch both flaws as a chain rather than individually, inventory any internet-exposed instances, and confirm that audit logging and EDR coverage are in place so they can distinguish opportunistic probing from an actual compromise.