Cybercriminals are chaining two major Microsoft SharePoint vulnerabilities to achieve Remote Code Execution (RCE) on unpatched servers. Security agencies are issuing urgent warnings to defenders worldwide.

  • Attackers are chaining CVE-2026-55040 and CVE-2026-63520 to bypass authentication and execute code.
  • Publicly available Proof-of-Concept (PoC) exploits have accelerated the weaponization of these flaws.
  • CISA has ordered federal agencies to secure SharePoint servers immediately.

A sophisticated new threat is emerging in the cybersecurity landscape. According to threat intelligence firm Defused, attackers are now successfully chaining two distinct vulnerabilities in Microsoft SharePoint to perform Remote Code Execution (RCE). This exploit chain allows unauthenticated attackers to hijack unpatched servers and execute arbitrary code, potentially leading to full system compromise.

The first link in this deadly chain is CVE-2026-55040, an authentication bypass flaw residing in the JWT token validation pipeline. This vulnerability allows attackers without any prior privileges to masquerade as a SharePoint site user or even a high-level administrator. Once the identity is compromised, the attacker moves to the second phase.

Read Also:Meta Launches 'Pocket' AI: Turning Game Ideas into Reality Without Code

The second component, CVE-2026-63520, targets SharePoint's Business Connectivity Services (BCS). By exploiting this flaw after bypassing authentication, attackers can achieve RCE, granting them the ability to run malicious commands directly on the targeted server.

Why This Matters

BozokMedia analysis shows that the speed of exploitation has increased significantly due to the release of Proof-of-Concept (PoC) exploits. Security researcher Stephen Fewer and Jonathan Peterson released PoC code that has since been weaponized by threat actors, turning theoretical vulnerabilities into active, real-world weapons.

The availability of public PoC exploits drastically reduces the barrier to entry for low-skilled attackers, making rapid patching a matter of survival.

The scale of the risk is immense. Internet security non-profit Shadowserver reports that over 8,700 Microsoft SharePoint servers are currently exposed to the public internet. Without proper hardening, these servers serve as open doors for ransomware gangs and state-sponsored actors.

In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued urgent directives to federal agencies to secure their environments. This follows a trend where SharePoint flaws have been a primary target; since 2021, CISA has flagged 15 actively exploited SharePoint vulnerabilities, many of which were utilized in devastating ransomware attacks.

Did You Know?: Once an attacker gains valid credentials, traditional prevention defenses often fail to block up to 63% of their subsequent malicious actions.

Frequently Asked Questions

Question 1: How can I protect my SharePoint environment?
Answer: Ensure all security patches are applied immediately and avoid exposing SharePoint servers directly to the internet whenever possible.

Question 2: What is the significance of CVE-2026-63520?
Answer: It is the critical RCE flaw that allows attackers to run malicious code after they have bypassed the initial authentication layer.