Rapid7 has disclosed the missing half of an exploit chain that gives an attacker complete code execution on a Microsoft SharePoint server without a username, a password or a single click from a victim. The company published the second flaw, a remote code execution bug tracked as CVE-2026-63520, in a disclosure on August 11, alongside a technical analysis and working proof of concept for the first half. Microsoft has patched both.
Each bug is serious on its own. Together they are considerably worse. CVE-2026-55040, the authentication bypass Rapid7 and Microsoft disclosed on July 14 and which IntelFusions covered when it let attackers impersonate any SharePoint user, gets an unauthenticated attacker in the door. CVE-2026-63520 then lets them run whatever they want once inside.
What is affected
CVE-2026-63520 carries a CVSS v3.1 score of 8.1 (High) and is classified as improper input validation (CWE-20). Rapid7 traces it to an unsafe .NET type instantiation issue in SharePoint's Business Connectivity Services, and says an attacker can craft a custom .NET gadget chain to run arbitrary operating system commands with the privileges of the Windows service account behind the SharePoint site. Full technical details are being held back for up to 30 days.
The affected list is broad: SharePoint Server Subscription Edition and its Language Pack, SharePoint Server 2019, SharePoint Enterprise Server 2016, Project Server 2013 Service Pack 1 (64-bit), and Office Web Apps 2013 Service Pack 1. The authentication bypass affects SharePoint only.
How the bypass works
The analysis published today explains why the front door opened. SharePoint's service-to-service authentication uses a nested JSON Web Token, a signed credential that carries a user's identity claims wrapped around an inner actor token representing the calling application. Rapid7's Stephen Fewer found a chain of four distinct weaknesses in how that token is validated, the most consequential being a single line in the validation code that sets RequireSignedTokens to false. That switches off cryptographic signature verification entirely, so the library accepts a token declaring no signature algorithm at all, parses its claims and trusts them. Audience and issuer validation are disabled in the same block. The upshot is that a remote attacker can forge a token and act as any site user, including an administrator.
The part that is not about SharePoint
Rapid7 says the chain came out of a research project testing whether publicly available AI models could find and weaponize a serious vulnerability in a hard, proprietary enterprise target. It could. By the company's own accounting, the agent accrued 120 hours of run time spread over 24 days, leveraged 96 sessions, generated approximately 80,000 agentic tool calls, and took 256 prompts from the team. The authentication bypass was verified in early March and the RCE followed two weeks later.
The candid parts are the useful ones. A fully automated approach did not work: early results were, in Rapid7's words, questionable or simply inaccurate, and an expert steering the agent was crucial. The team also caught the agent cutting corners to reach its goal, including unexpectedly replaying admin credentials, enabling debug flags and reading secrets, none of which were in the original threat model. The chain was built as a Pwn2Own Berlin entry that did not succeed on the day of the competition.
What you should do
Apply the latest available updates for SharePoint, Project Server and Office Web Apps. Microsoft split the fixes across two cycles, the bypass in July and the RCE in August, so a server patched only through July is still exposed to the second half. Rapid7 first reported the chain to Microsoft on May 18, 2026, and Microsoft thanked the company for reporting it through coordinated disclosure. With a proof of concept for the bypass now public, treat SharePoint patching as urgent rather than routine, and check for the access that survives a patch: attackers who reached a server earlier can keep it after the update lands if stolen machine keys are not rotated.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.