1. Basic Information
- Article Title: Hackers target Microsoft SharePoint RCE chain with PoC exploit
- Publisher: BleepingComputer
- Publication Date: August 26, 2026
- Source: BleepingComputer
- Related Sources: Rapid7 analysis of CVE-2026-55040, VulnCheck analysis of CVE-2026-63520, Microsoft CVE-2026-63520 advisory
- Related Malware, Threat Groups, CVEs, Products: CVE-2026-55040, CVE-2026-63520, Microsoft SharePoint Server
- Severity: High
2. Executive Summary
Attackers are executing a SharePoint JWT authentication bypass, enumerating administrative functions, and searching for the CVE-2026-63520 RCE sink within the Business Data Catalog. However, code execution has not been confirmed at the time of observation.
3. Attack Flow
Chain Attempt from Authentication Bypass to BCS RCE Sink
- An unauthenticated attacker exploits the JWT token validation flaw in CVE-2026-55040 to act as a user or administrator on the SharePoint site.
- After bypassing authentication, the attacker enumerates numerous SharePoint administrative functions.
- They search for the CVE-2026-63520 RCE sink within Business Connectivity Services (BCS) and the Business Data Catalog (BDC).
- Honeypots observed the JWT authentication bypass, administrative function enumeration, and searching, but did not observe code execution.
4. Attacker Position and Execution Location
- Unauthenticated attackers reaching an internet-facing SharePoint Server.
- After successfully exploiting CVE-2026-55040, attackers may be able to perform API operations as a SharePoint site user or administrator.
5. Visibility for Victims and Administrators
Victims
- Because user interaction is not required, it is difficult to notice the attack from standard SharePoint screens.
Administrators
- The activity may appear as abnormal JWTs, administrative API enumeration originating from unauthenticated traffic, and repeated search requests to the Business Data Catalog.
- If RCE succeeds, it progresses to abnormal child process creation or file changes under the SharePoint / IIS worker process.
6. Success and Failure Conditions
Success Conditions
- Using an on-premises SharePoint Server that is vulnerable to both CVE-2026-55040 and CVE-2026-63520.
- The attacker can reach the target server over the network.
- Reaching the BCS / BDC functions after bypassing authentication.
Failure Conditions / Risk Mitigation
- Apply the relevant Microsoft security updates.
- Stop unnecessary direct internet exposure and restrict access to administrative surfaces and BCS.
- Block post-authentication management operations using application controls, WAFs, and network controls.
7. What Happens on Success
- The authentication bypass may allow attackers to operate as a SharePoint site user or administrator.
- Successfully chaining the two vulnerabilities may allow remote code execution on the SharePoint Server.
- Subsequent access to documents, credentials, and internal network destinations may occur. However, RCE and subsequent access are not confirmed facts in this honeypot observation.
8. Observable Logs
- Email: Not directly related.
- Proxy/SWG/DNS: Requests to SharePoint with abnormal JWTs, enumeration of management endpoints, and Business Data Catalog-related requests.
- Endpoint/EDR: Spawning of shells, PowerShell, cmd, script engines, or file writes under IIS / SharePoint processes, expected upon successful RCE. Not confirmed in this observation.
- Identity/IdP: SharePoint privileged operations occurring without a corresponding legitimate login.
- SaaS/Cloud: SharePoint audit logs, site collection / administrator operations, and document access.
- Network: Concentration of discovery requests from the internet to SharePoint, and outbound traffic from the server expected after successful compromise.
9. Attack Success Determination
- Attack Attempt Observed (Success Unconfirmed): Honeypots observed discovery efforts chaining CVE-2026-55040 and CVE-2026-63520. Successful RCE is unconfirmed.
- Malware Execution or Authentication Success Confirmed: Application telemetry confirms that the JWT authentication bypass executed and proceeded to unauthenticated management function enumeration. This does not imply successful RCE.
- Initial Execution Confirmed: Host telemetry confirms arbitrary code execution under the SharePoint / IIS worker process. This stage is unconfirmed in public reports.
10. Investigation Playbook
- Trigger: Detect reconnaissance related to CVE-2026-55040 / CVE-2026-63520, abnormal JWTs, and unauthenticated administrative function enumeration.
- Initial Verification: Verify the SharePoint version, security update status, internet exposure, and BCS / BDC usage. Align web, IIS, SharePoint audit logs, and EDR process telemetry to the same timeline.
- Endpoints: Check for child processes spawned from w3wp or similar, PowerShell / cmd, web shells, file writes, scheduled tasks, and service modifications.
- Authentication / Cloud: Cross-reference request actors with Entra / AD logins to investigate privileged operations lacking a corresponding login.
- Subsequent Activity: Check for document access, credential access, service account usage, lateral movement, and external transmission.
- Containment: Apply the relevant updates, and restrict unnecessary internet exposure and BCS functions. If RCE is confirmed, isolate the host and rotate SharePoint, IIS, and service account credentials.
- Determination Categories: Record reconnaissance, successful JWT authentication bypass, management function enumeration, RCE, and subsequent compromise in separate stages.
11. Defense and Detection Ideas
- Single Events: Detect SharePoint management operations without corresponding logins, abnormal JWTs, and rapid enumeration of administrative endpoints.
- Time-Series Correlation: Correlate potential JWT authentication bypass -> management function enumeration -> BDC search -> IIS child process / file write.
- Threat Hunting: Inventory internet-exposed SharePoint servers, BCS usage, and patch statuses for CVE-2026-55040 / CVE-2026-63520.
- Log Gaps: Reverse proxy logs alone cannot confirm successful JWT authentication bypass or RCE. SharePoint audit logs and host process telemetry are required.
- Priority Actions: Apply security updates for both CVEs. Stop direct internet exposure of SharePoint or restrict source connections. Retain IIS / SharePoint audit logs and EDR logs.
12. Facts / Inference / Hypothesis
Facts
- PoCs for CVE-2026-55040 and CVE-2026-63520 were released on August 11, 2026, and August 24, 2026, respectively.
- Defused honeypots observed JWT authentication bypass, administrative function enumeration, and CVE-2026-63520 BDC RCE sink searching on August 25.
- Code execution was not confirmed at the time of observation.
- Microsoft assesses CVE-2026-63520 as a likely target for attackers, but did not mark it as actively exploited at the time of the article.
- Shadowserver tracks over 8,700 internet-exposed SharePoint servers, which does not mean they are vulnerable or compromised.
Inference
- The release of PoCs and the observation of successful authentication bypasses likely increase scans attempting the subsequent RCE in the chain.
- Treating a successful authentication bypass as synonymous with successful RCE leads to misjudged incident severity and response decisions.
Hypothesis
- The relationship between the actors performing reconnaissance against honeypots and past attack campaigns actively exploiting SharePoint is unknown.
13. MITRE ATT&CK Mapping
- T1190 Exploit Public-Facing Application (High): Attempting an authentication bypass and RCE chain against internet-facing SharePoint.
14. Unknowns / Further Investigation
- Successful actual code execution, victim organizations, threat actors, and payloads associated with CVE-2026-63520.
- The proportion of vulnerable servers among the 8,700+ exposed instances.
15. Impact on SOCs and General Enterprises
Enterprises running on-premises SharePoint exposed to the internet should prioritize patching both CVEs as a chain rather than treating them separately. SOCs should separate JWT authentication bypass success, administrative function enumeration, and RCE into distinct stages, avoiding treating reconnaissance requests alone as a confirmed compromise.
16. Summary by Target Audience
- For SOCs: Correlate JWT authentication bypass -> management function enumeration -> BDC search -> host-level code execution, and separate observed attack attempts from unconfirmed RCE.
- For Administrators: Patch both CVEs, and restrict direct internet exposure of SharePoint and unnecessary BCS/administrative surfaces.
- For Users: Because servers are targeted without user interaction, administrator patching and reviews of exposure scope are required.
