Researchers have published a working exploit chain that turns two recently disclosed on-premises
Microsoft SharePoint Server flaws into unauthenticated remote code execution. An attacker first forges
a login token to bypass authentication (CVE-2026-55040), then abuses an unsafe .NET type-loading
weakness in SharePoint’s Business Connectivity Services to run their own code on the server (CVE
2026-63520). The authentication-bypass half is already being exploited in the wild and sits in CISA’s
Known Exploited Vulnerabilities catalog, and security firm VulnCheck estimates at least 8,500
SharePoint servers are exposed online. Microsoft’s August 2026 cumulative update (KB5002893) fixes
both issues, so every internet-facing on-premises SharePoint server should be patched and checked
for compromise as a priority.
1. Vulnerability Details
CVE ID – CVE-2026-55040 (auth bypass) + CVE-2026-63520 (RCE)
EXPLOIT STATUS – CVE-2026-55040 exploited in the wild since 11 Aug 2026 (CISA KEV, 18 Aug); full RCE chain publicly demonstrated by VulnCheck.
Two on-premises SharePoint Server flaws, both discovered by Rapid7’s Stephen Fewer, combine into unauthenticated remote code execution: an attacker forges a JSON Web Token to bypass authentication, then abuses unsafe .NET type instantiation in Business Connectivity Services to execute code as the SharePoint service account.
- CVE-2026-55040 (JWT authentication bypass) SharePoint’s token handler (SPJsonWebSecurityTokenHandlerV2) does not validate JWTs properly, so an unauthenticated attacker who knows a privileged user’s SID or user principal name can forge a token (using an “alg”:”none” header) to act as that user and retrieve a FormDigest value from a privileged endpoint.
- CVE-2026-63520 (unsafe .NET type instantiation) Business Connectivity Services instantiates .NET types named in an uploaded Business Data Catalog model without adequate restriction. Using the forged identity, an attacker uploads a malicious BDCM defining the type System.Web.UI.LosFormatter with a Finder-bound Deserialize method, then triggers it to run an arbitrary payload as the SharePoint service.
2. Affected Products
- On-premises Microsoft SharePoint Server running the Business Connectivity Services component (editions covered by the August 2026 cumulative update).
- Fix: Microsoft’s August 2026 SharePoint cumulative update, KB5002893, which introduces the ValidateSafeBcsType check and the BCSAllowedTypeNames allow-list restricting which .NET types Business Connectivity Services may load.
3. Exploitation Status
Exploitation activity to date centres on the authentication-bypass half of the chain.
- Auth bypass (CVE-2026-55040): Honeypot providers reported in-the-wild exploitation immediately after Rapid7 published its proof of concept on 11 August 2026. The flaw was added to VulnCheck KEV on 12 August and CISA KEV on 18 August.
- Full RCE chain (CVE-2026-63520): VulnCheck has publicly demonstrated a working end-to-end RCE exploit and shipped detections (Suricata/Snort rules, PCAPs, a version scanner) to its customers. Given roughly 8,500 exposed servers, treat exploitation of the full chain as imminent.
4. Recommendations
- Apply Microsoft’s August 2026 SharePoint Server cumulative update (KB5002893) to all on-premises servers without delay; it remediates both CVE-2026-55040 and CVE-2026-63520 by allow-listing the .NET types Business Connectivity Services may load. Prioritise internet-facing servers.
- Reduce exposure until patched: remove SharePoint from direct internet exposure or place it behind a web application firewall or authenticating reverse proxy, and restrict access to the /_vti_bin/client.svc/ProcessQuery endpoint and Business Connectivity Services functionality.
- Hunt for the authentication bypass: alert on requests to SharePoint carrying a JWT whose header base64 decodes to {“alg”:”none”,…}, and on anomalous privileged FormDigest retrievals from unauthenticated or unusual sources.
- Hunt for the RCE chain: alert on creation of a document library named ‘BusinessDataMetadataCatalog’, uploads of .bdcm files via the Files/add API, and ProcessQuery calls that register external lists, especially Business Data Catalog models referencing System.Web.UI.LosFormatter or other unexpected .NET types. Deploy VulnCheck’s published Suricata and Snort rules if you subscribe.
- Treat any exploited server as compromised: review for web shells and unexpected child processes spawned by the IIS worker process (w3wp.exe), rotate SharePoint service and farm credentials and the ASP.NET machine keys, and forensically review or rebuild affected hosts.
5. Sources
- https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.