Critical Microsoft SharePoint Flaws Let Attackers Hack Servers Remotely

Key Takeaways

• Two critical vulnerabilities in Microsoft SharePoint Server can be chained for remote, unauthenticated server takeover.
• The flaws, CVE-2026-55040 (authentication bypass) and CVE-2026-63520 (remote code execution), affect SharePoint Server Subscription Edition, 2019, and 2016.
• CVE-2026-55040 has a CVSS v3.1 score of 9.1, while CVE-2026-63520 is rated 8.1.
• Microsoft has released patches; immediate installation is strongly advised, especially for internet-facing instances.
• SharePoint Online in Microsoft 365 is not impacted.

Critical SharePoint Vulnerabilities Allow Remote Server Compromise

A pair of severe vulnerabilities within Microsoft SharePoint Server deployments could allow unauthenticated attackers to gain complete control over affected servers. The attack chain leverages an authentication bypass, identified as CVE-2026-55040, in conjunction with a remote code execution (RCE) flaw, CVE-2026-63520.

Authentication Bypass: CVE-2026-55040

The first vulnerability, CVE-2026-55040, carries a critical CVSS v3.1 score of 9.1 out of 10. This flaw resides in SharePoint’s JSON Web Token (JWT) authentication handler. It permits an attacker to forge a valid authentication token, effectively impersonating any SharePoint user, provided they know the user’s security identifier or User Principal Name (e.g., user@domain).

The root cause of this vulnerability stems from inadequate or disabled security checks within SharePoint’s token validation process. Rapid7 researchers found that the RequireSignedTokens setting was configured to allow unsigned outer JWTs. Furthermore, the affected code failed to correctly verify signatures for embedded actor tokens in certain scenarios. This oversight transforms a simple authentication weakness into a critical entry point for more sophisticated attacks, enabling an attacker to authenticate as a SharePoint administrator and access privileged endpoints without requiring valid credentials. Rapid7 publicly disclosed CVE-2026-55040 on August 11, 2026, following its initial disclosure on July 14.

Remote Code Execution: CVE-2026-63520

The second vulnerability in this chain, CVE-2026-63520, is a high-severity remote code execution flaw with a CVSS score of 8.1. This vulnerability impacts Business Connectivity Services (BCS), a SharePoint component designed to integrate external data systems and .NET applications with SharePoint.

Prior to Microsoft’s security updates, BCS lacked proper restrictions on the .NET types that could be loaded from a Business Data Connectivity (BDC) model. An attacker who has already bypassed authentication can exploit this by submitting a malicious BDC model specifying an unsafe class. Researchers discovered that the System.Web.UI.LosFormatter class could be manipulated as a deserialization gadget, leading to arbitrary code execution on the SharePoint server.

The Full Attack Chain

In a complete attack scenario, a threat actor first utilizes CVE-2026-55040 to forge a JWT and impersonate a privileged SharePoint account. Once authenticated, the attacker obtains a form digest value, uploads a malicious BDC model, creates an external list, and subsequently triggers the vulnerable BCS processing path. This sequence ultimately results in arbitrary code execution within the SharePoint server environment.

DefusedCyber stated on X that VulnCheck released details of this vulnerability chain on August 24, 2026, including a functional exploit and detection materials for its customers. VulnCheck also highlighted that a substantial number of SharePoint deployments are exposed to the public internet. Censys data cited in the disclosure identified approximately 21,000 on-premises instances that expose version details. It is important to note that SharePoint Online, part of Microsoft 365, is not affected by these vulnerabilities.

Microsoft has released crucial security updates addressing these flaws for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CVE-2026-55040 was added to CISA’s Known Exploited Vulnerabilities catalog on August 18, confirming that active exploitation of the authentication bypass was already occurring in the wild.

What You Should Do

• Immediately apply the latest August security updates from Microsoft for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
• Prioritize patching for all internet-facing SharePoint servers, as they represent the highest risk.
• Investigate any unusual bearer-token authentication attempts or unexpected BDC model uploads within your SharePoint environment.
• Monitor for suspicious requests targeting Business Data Catalog endpoints.
• Treat any unpatched on-premises SharePoint servers as high-risk systems, especially those accessible from external networks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.