Critical SharePoint Flaws Enable Unauthenticated RCE via AI Discovery

Rapid7 researchers have disclosed two critical vulnerabilities in Microsoft SharePoint Server that, when chained together, allow unauthenticated remote code execution on enterprise servers. The flaws, tracked as CVE-2026-55040 and CVE-2026-63520, affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, along with Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1. SharePoint Online is not impacted by either issue.

The attack begins with CVE-2026-55040 (CVSS 9.1), an authentication bypass rooted in SharePoint's JSON Web Token (JWT) validation pipeline. An attacker only needs the target user's Active Directory security identifier (SID) or user principal name (UPN) to impersonate them, including site administrators. Rapid7's proof-of-concept queries a domain controller to enumerate users by SID, then escalates to the site administrator. Once impersonation succeeds, the intruder chains it to CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in SharePoint's Business Connectivity Services that executes attacker code as the Windows service account. Organizations should run a email breach checker to verify whether administrator credentials may already be circulating in underground markets, and use a port scanner to confirm no SharePoint endpoints are unnecessarily exposed to the public internet.

Notably, the discovery itself was AI-assisted. Rapid7 conducted two research sprints against the SharePoint codebase in January and March 2026. The January sprint produced no usable findings, but the March effort spanning 24 active days, 96 sessions, 256 prompts, and roughly 80,000 tool calls delivered the two-vulnerability chain through heavily prompted AI agentic work. Researchers emphasized that fully automated approaches would have failed, as the model frequently produced questionable or inaccurate results that required expert steering and validation at every stage.

Rapid7 states that the July update breaks the exploit chain, and administrators running on-premises SharePoint should verify that update is installed immediately while awaiting Microsoft's August patch, which had not yet appeared in the update history at the time of disclosure. CISA filed the bypass to the National Vulnerability Database on July 14, marking the attack automatable with total technical impact, though no active exploitation was confirmed at that point. Given the severity and the established precedent of SharePoint exploits being weaponized by ransomware operators, defenders should prioritize patching, audit privileged account exposure, and rotate any potentially compromised credentials. A password checker can help security teams verify that administrative passwords meet current complexity and uniqueness standards.