Microsoft SharePoint RCE Chain Is Being Exploited With a Public PoC

• The Mess: Attackers are reportedly targeting vulnerable Microsoft SharePoint servers with a publicly available proof-of-concept exploit for an RCE attack chain. Once exploit code becomes easy to obtain, unpatched servers stop being interesting only to researchers — and start attracting everyone else.

The new chain involves two separate vulnerabilities:

• CVE-2026-55040 — an authentication bypass in SharePoint’s JWT token validation pipeline.
• CVE-2026-63520 — a flaw in SharePoint Business Connectivity Services that can be chained with the first bug to achieve remote code execution.

According to threat intelligence company Defused, attackers are already targeting the chain against unpatched SharePoint Server installations, and a public proof of concept is available.

The Attack Starts Without Valid Credentials

The first flaw is what makes the chain particularly dangerous.

CVE-2026-55040 can reportedly allow an attacker without existing privileges to bypass authentication and perform actions as a SharePoint site user or administrator.

That means the attack doesn’t necessarily begin with:

stolen password → login → compromise.

It can begin with:

Internet → authentication bypass → privileged SharePoint access.

Then the attacker moves to the second vulnerability.

The Second Bug Turns Access Into Code Execution

The chain uses CVE-2026-63520 in SharePoint’s Business Connectivity Services.

Once the authentication barrier has been bypassed, the attacker can reportedly use the second flaw to execute arbitrary code on the targeted SharePoint Server.

The result is the kind of attack chain administrators hate:

no credentials → bypass authentication → RCE → server compromise.

And because the proof of concept is public, attackers don’t need to independently discover the chain from scratch.

They can adapt existing research.

SharePoint Servers Are Attractive Targets for a Reason

An on-premises SharePoint server is rarely an isolated machine.

It can contain:

• internal documents;
• employee information;
• project data;
• authentication integrations;
• business workflows;
• connections to other Microsoft services.

So an RCE vulnerability is not just about crashing a server or defacing a page.

A compromised SharePoint server can become a foothold inside the organization.

And that is why Microsoft has repeatedly treated on-premises SharePoint as a high-value target. Previous SharePoint exploitation campaigns demonstrated how quickly attackers can move from a public vulnerability to real-world compromise of enterprise servers.

The Public PoC Changes the Timeline

There is always a dangerous transition after a vulnerability becomes public.

At first:

researchers understand the bug.

Then:

a proof of concept appears.

Then:

attackers start scanning.

And finally:

someone discovers they were patched too late.

The current reports place this SharePoint chain somewhere after the second stage.

The research is public.

The PoC is available.

And attackers are already targeting vulnerable servers.

That’s enough reason to stop treating this as a routine maintenance update.

Patch Before You Become a Test Server

Organizations running affected on-premises SharePoint infrastructure should apply Microsoft’s security updates for the relevant vulnerabilities and verify that all required components have actually been updated.

Don’t assume:

“Windows Update ran, so SharePoint must be fine.”

SharePoint patching can involve product-specific security updates and version requirements.

Also remember:

SharePoint Online is a different environment from self-hosted SharePoint Server.

The reported attack chain targets vulnerable SharePoint Server installations, not Microsoft 365’s SharePoint Online service.

If the Server Was Exposed, Hunt for More Than the Vulnerability

Because attackers are already targeting the chain, patching should be followed by compromise checks.

Look for:

• unusual SharePoint administrator activity;
• unexpected authentication events;
• suspicious processes spawned by SharePoint services;
• new or modified files;
• unexpected scheduled tasks or services;
• unusual outbound connections;
• web shells or other persistence;
• abnormal activity involving Business Connectivity Services.

And if you find evidence of compromise, assume that credentials and secrets accessible from the SharePoint server may also need to be rotated.

Again:

patching closes the vulnerability.

It does not automatically remove the attacker.

This Is Not ToolShell 2.0

The comparison will be inevitable.

SharePoint was heavily targeted in 2025 through the ToolShell exploit chain, where multiple vulnerabilities allowed attackers to compromise on-premises servers, often without credentials. That campaign quickly moved from disclosure to active exploitation.

But the current 2026 activity involves a different pair of CVEs:

CVE-2026-55040

and

CVE-2026-63520.

Different bugs.

Same uncomfortable target.

And once again, the attackers appear to be moving quickly.

Bugstoday Opinion

SharePoint keeps proving one thing:

enterprise collaboration platforms are too valuable to attackers to ignore.

These servers contain the documents companies don’t want stolen.

They sit inside environments with authentication systems and business applications.

And when a public PoC appears for an authentication-bypass-to-RCE chain, the clock starts immediately.

Not next month.

Not during the next maintenance window.

Immediately.

The most worrying part isn’t that a proof of concept exists.

PoCs appear constantly.

The worrying part is that attackers are already using this chain against vulnerable servers.

Bugstoday verdict: CVE-2026-55040 and CVE-2026-63520 turn an unpatched SharePoint Server into exactly the kind of target attackers love — a public-facing enterprise system where an authentication bypass can lead directly to remote code execution. The PoC is public, the attacks have started, and your SharePoint server should not become someone else’s test environment.