Key Takeaways
- Two SharePoint vulnerabilities—CVE‑2026‑55040 (authentication bypass) and CVE‑2026‑63520 (improper input validation)—can be chained to enable unauthenticated remote code execution.
- While CVE‑2026‑55040 alone offers limited impact, combining it with CVE‑2026‑63520 yields a critical exploit chain.
- Proof‑of‑concept code was first disclosed by Rapid7 on Aug 11; exploitation of the bypass was confirmed shortly thereafter.
- VulnCheck added CVE‑2026‑55040 to its Known Exploited Vulnerabilities catalog on Aug 12, and CISA followed on Aug 18.
- Approximately 8,500 SharePoint servers are publicly accessible, creating a broad attack surface.
- Defused observed probing activity matching the full chain on its honeypots, indicating active threat actor interest.
- Organizations should prioritize patching, restrict external exposure of SharePoint, and monitor for anomalous authentication and input‑validation behavior.
Overview of the Disclosed Vulnerabilities
VulnCheck researchers published a detailed analysis on Monday describing two critical flaws affecting Microsoft SharePoint. The first flaw, tracked as CVE‑2026‑55040, is an authentication bypass that allows an attacker to circumvent login mechanisms without needing valid credentials. The second flaw, CVE‑2026‑63520, involves improper input validation in a SharePoint component, which can be leveraged to execute arbitrary code once the attacker has gained a foothold. Individually, each vulnerability presents a risk, but their true danger emerges when they are used together in a specific sequence.
How the Exploit Chain Works
The attack begins with the authentication bypass (CVE‑2026‑55040). By exploiting this weakness, an unauthenticated attacker can obtain a valid session or token that grants them access to SharePoint functions normally reserved for authenticated users. With this foothold established, the attacker then targets the improper input validation flaw (CVE‑2026‑63520). By supplying specially crafted input to a vulnerable parameter, the attacker can trigger a code execution path that runs arbitrary commands on the underlying server. The chaining of these two issues transforms a modest bypass into a full‑blown remote code execution (RCE) scenario.
Initial Disclosure and Proof‑of‑Concept
The exploit chain was first brought to public attention by researchers at cybersecurity firm Rapid7, who released a proof‑of‑concept (PoC) on August 11. Their PoC demonstrated that the authentication bypass could be triggered reliably, laying the groundwork for further exploitation. Rapid7’s disclosure served as a catalyst for the security community to begin monitoring for active abuse of the vulnerability.
Confirmation of the Authentication Bypass
Within days of Rapid7’s posting, independent analysts confirmed that CVE‑2026‑55040 was being exploited in the wild. VulnCheck researchers noted that, while the bypass alone could prove some impact—such as gaining unauthorized access to SharePoint sites—it did not, by itself, demonstrate the full criticality of the combined attack. This observation underscored the necessity of chaining the bypass with the input‑validation flaw to achieve a meaningful compromise.
Cataloging the Vulnerability
Recognizing the growing threat, VulnCheck added CVE‑2026‑55040 to its Known Exploited Vulnerabilities (KEV) catalog on August 12. The inclusion in the KEV list signals to defenders that the flaw is actively being exploited and warrants urgent remediation. Subsequently, the Cybersecurity and Infrastructure Security Agency (CISA) incorporated the same vulnerability into its own KEV catalog on August 18, further amplifying the call for immediate action across federal and private sectors.
Exposure of SharePoint Servers
VulnCheck’s Internet‑wide scanning revealed that roughly 8,500 SharePoint servers are directly accessible from the public internet. This figure highlights a substantial attack surface, as each exposed instance represents a potential entry point for the described exploit chain. The large number of reachable servers amplifies the urgency for organizations to assess their external SharePoint footprint and apply mitigations where necessary.
Observed Probing Activity
On Tuesday, researchers from Defused reported that they had already detected probing attempts against their honeypots that matched the full chained sequence (CVE‑2026‑55040 followed by CVE‑2026‑63520). The activity, shared via a post on X (formerly Twitter), indicates that threat actors are actively scanning for vulnerable SharePoint deployments and attempting to weaponize the exploit chain in real time. Such observations validate the likelihood of widespread exploitation if defenses are not strengthened.
Prior Warnings from CISA
Earlier in July, CISA had already issued advisories warning that multiple vulnerabilities within Microsoft SharePoint were under active exploitation. The July alert set the stage for the later disclosures, emphasizing that SharePoint remains a frequent target for attackers seeking to infiltrate enterprise networks. The recent chain of CVE‑2026‑55040 and CVE‑2026‑63520 aligns with the patterns highlighted in that earlier warning, reinforcing the need for continuous vigilance.
Mitigation Recommendations
To defend against this exploit chain, organizations should take the following steps:
- Apply Patches Promptly – Install the latest security updates from Microsoft that address both CVE‑2026‑55040 and CVE‑2026‑63520.
- Restrict External Access – Where possible, limit SharePoint exposure to internal networks or place it behind a VPN, zero‑trust gateway, or web application firewall (WAF).
- Enforce Strong Authentication – Deploy multi‑factor authentication (MFA) and monitor for anomalous authentication attempts that could signal bypass exploitation.
- Input Validation Controls – Implement additional validation layers at the application or WAF level to block malformed inputs that could trigger CVE‑2026‑63520.
- Logging and Monitoring – Enable detailed logging for SharePoint access and execution events; set alerts for unusual patterns such as sudden spikes in anonymous requests or unexpected command execution.
- Vulnerability Scanning – Regularly scan internal and external assets for the presence of the two CVEs using trusted vulnerability management tools.
By combining timely patching with network segmentation and robust monitoring, organizations can significantly reduce the risk posed by this chained SharePoint exploit.
Conclusion
The discovery of CVE‑2026‑55040 and CVE‑2026‑63520 demonstrates how seemingly modest flaws can be combined to produce a critical remote code execution threat in widely deployed collaboration platforms like SharePoint. Rapid validation by multiple security firms, the addition of the vulnerabilities to official KEV catalogs, and observed probing activity all point to an active exploitation landscape. Immediate patching, reduced exposure, and heightened detection capabilities are essential defenses for any organization relying on SharePoint for business operations.