Reported by 6 outlets

Timeline

1. original reporting

   CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

   rapid7.com · 63d ago · August 11th, 2026

   Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first vulnerability in the chain, CVE-2026-55040, was disclosed by Rapid7 and Microsoft last month. Our full disclosure timeline for the exploit chain can be seen below in Figure 1. Figure 1: The road to disclosure. ⠀ CVE-2026-63520 affects all supported versions of Microsoft SharePoint, and certain versions of Microsoft Project Server and Microsoft Office Web Apps Server. For the purpose of our research, we focused solely on SharePoint. An attacker can leverage CVE-2026-63520 to execute arbitrary code on a vulnerable SharePoint server with the privileges of the SharePoint Site’s service account. The vulnerability is due to an unsafe .NET type instantiation issue within the Business Connectivity Services . CVE-2026-63520 has a CVSSv3.1 score of 8.1 (High) , and a Common Weakness Enumeration (CWE) of CWE-20: Improper Input Validation . While the severity of the RCE is described as high, chained together with CVE-2026-55040 it becomes part of a critical unauthenticated RCE exploit chain against SharePoint. The exploit chain was developed as an entry for this year's Pwn2Own Berlin hacking

2. update from securityweek.com

   CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities

   securityweek.com · 90d ago · July 16th, 2026

   Previously covered July 15 (Patch Tuesday). New: CISA issues urgent standalone advisory on the exploited SharePoint flaws.

   CISA has issued a separate advisory urging organizations to immediately patch the two SharePoint vulnerabilities exploited in the wild: CVE-2026-56164 (elevation of privilege, missing authentication for a critical function) and the related CVE-2026-55040 (Rapid7's JWT token authentication bypass, CVSS 9.1). SharePoint Server 2016 and 2019 reached end of extended support on July 14, 2026 — no ESU available. Organizations running SharePoint Subscription Edition should prioritize patching; those on unsupported versions should migrate immediately.

3. update from bleepingcomputer.com

   CISA: Microsoft SharePoint flaw now exploited in ransomware attacks

   bleepingcomputer.com · 63d ago · August 11th, 2026

   CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. Tracked as CVE-2026-45659 , this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers. It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) "an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV) on July 1 , ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the U.S. cybersecurity agency warned at the time. In a subsequent advisory , the cybersecurity agency also urged security teams to monitor affected servers for signs of exploitation, apply Microsoft's latest patches, verify successful installation, and shorten patching cycles. It also recomme

4. update from rapid7.com

   Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

   rapid7.com · 63d ago · August 11th, 2026

   Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script . Analysis The following technical analysis is based upon SharePoint Server Subscription Edition version 16.0.19725.20210. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. The below analysis is based upon decompilation and code review of the Microsoft.SharePoint.IdentityModel module from a fully patched SharePoint Server Subscription Edition instance. The vulnerability resides in the SPJsonWebSecurityTokenHandlerV2 class and its base class SPJsonWebSecurityBaseTokenHandlerV2, which together implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens. SharePoint's S2S authentication uses a nested JWT stru

5. update from cyberpress.org

   Microsoft SharePoint RCE Flaw Chains Allow Unauthenticated Server Takeover

   cyberpress.org · 62d ago · August 12th, 2026

   A newly disclosed Microsoft SharePoint Server vulnerability is raising urgent concerns for enterprise defenders after researchers demonstrated how it can be combined with an earlier flaw to enable unauthenticated remote code execution (RCE). On its own, the vulnerability allows an unauthenticated remote attacker to execute code over the network under specific conditions. The component is designed to enable SharePoint to connect to and consume data from external business systems.

6. update from gbhackers.com

   Microsoft SharePoint RCE Vulnerability Lets Remote Attackers Execute Code

   gbhackers.com · 62d ago · August 12th, 2026

   This flaw has a severity rating of 8.1 out of 10 according to CVSS v3.1. It affects supported versions of Microsoft SharePoint, as well as certain deployments of Microsoft Project Server and Microsoft […] The post Microsoft SharePoint RCE Vulnerability Lets Remote Attackers Execute Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

7. update from bleepingcomputer.com

   Hackers leverage new Microsoft SharePoint exploit in attacks

   bleepingcomputer.com · 62d ago · August 12th, 2026

   "The authentication feature could be bypassed as this vulnerability allows impersonation," it said . "Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system." A detailed technical write-up on CVE-2026-55040 was published by Rapid7 security researcher Stephen Fewer on Tuesday, together with a PoC exploit . Earlier today, threat intelligence company Defused reported that Rapid7's exploit code has already been weaponized in attacks targeting its honeypots. "The vulnerability is a Microsoft SharePoint JWT auth bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday." Internet threat watchdog Shadowserver currently tracks over 8,50

8. mentioned by securityweek.com

   SharePoint Vulnerability Exploited Shortly After PoC Release

   securityweek.com · 62d ago · August 12th, 2026

9. mentioned by rapid7.com

   Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

   rapid7.com · 50d ago · August 24th, 2026

10. mentioned by gbhackers.com

    Microsoft SharePoint Flaws Let Unauthenticated Attackers Execute Remote Code

    gbhackers.com · 48d ago · August 26th, 2026

11. update from cyberpress.org

    Microsoft SharePoint Flaws Chain to Unauthenticated Remote Code Execution

    cyberpress.org · 48d ago · August 26th, 2026

    The urgency increased after Defused reported seeing probes targeting the complete exploit chain in its honeypot infrastructure. Microsoft SharePoint Flaws Defused has not observed code execution in these attempts, but the activity shows adversaries are actively assessing exposed servers for full compromise. The observed sequence follows VulnCheck’s publication of a detailed exploitation path that joins the two bugs. Its exploitability depends on security settings, including RequireSignedTokens, which is disabled by default. An attacker who knows a user’s SID or UPN can forge a JWT. That forged token can bypass SharePoint’s validation checks and let an unauthenticated remote actor impersonate the chosen acco

12. update from bleepingcomputer.com

    Hackers target Microsoft SharePoint RCE chain with PoC exploit

    bleepingcomputer.com · 48d ago · August 26th, 2026

    "The JWT bypass (55040) was exercised, followed by heavy admi

13. update from avleonov.com

    🚨 Microsoft SharePoint Auth Bypass (CVE-2026-55040) chains with CVE-2026-63520 for RCE, exploit code Aug11, VulnCheck KEV Aug12, CISA KEV Au

    avleonov.com · 29d ago · September 14th, 2026

    🚨 Microsoft SharePoint Auth Bypass (CVE-2026-55040) chains with CVE-2026-63520 for RCE, exploit code Aug11, VulnCheck KEV Aug12, CISA KEV Au

    via Mastodon https://avleonov.com/2026/09/13/i154-about-authentication-bypass-microsoft-sharepoint-cve202655040-vulnerability/