Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Swati KhandelwalAug 11, 2026Vulnerability / Enterprise Security

Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent.

The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's affected-product list covers only those three on-premises editions, and SharePoint Online is not among them.

It lets a remote unauthenticated attacker assume a chosen user's identity. The attack has one prerequisite: the intruder has to know which account they want to become, either by its Active Directory security identifier (SID) or its user principal name (UPN), which is formatted like an email address.

Rapid7 then chained the bypass to a separate remote code execution flaw and ran code on the server with no credentials. Microsoft and the firm disclosed that second flaw on August 11 as CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in SharePoint's Business Connectivity Services.

Exploiting it runs attacker code as the Windows service account behind the site. It reaches further than the bypass: Subscription Edition, 2019, and 2016 are all affected, along with Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1.

Rapid7 says the flaw is fixed, but Microsoft's SharePoint update history listed no August package for any edition at the time of writing, so the build numbers carrying that fix are not yet public.

Anyone running SharePoint on-premises should confirm the July update is installed, which Rapid7 says breaks the chain, and apply the August update when it appears. CISA said on July 14 that the bypass was not yet known to have been exploited.

The bypass sits in SharePoint's JSON Web Token (JWT) validation pipeline. Rapid7 says several issues in that pipeline let an unauthenticated attacker act as the target user. Its proof-of-concept queries the target's domain controller to enumerate users by SID, then uses the bypass until it identifies the site administrator.

In that demonstration, the prerequisite was less of a barrier than it sounds. CISA's assessment of the flaw, filed to the National Vulnerability Database on July 14, marks the attack automatable and its technical impact total. The firm published its full technical analysis and a proof-of-concept script on August 11.

Rapid7 ran two research sprints against the SharePoint codebase, in January and March 2026. January produced no usable chain. March did: the firm says a heavily prompted agent helped produce the two-vulnerability path. Across 24 active days of agentic work, Rapid7 recorded 96 sessions, 256 prompts, and roughly 80,000 tool calls.

A fully automated approach would not have worked, the firm says, because the model too often produced findings that were questionable or inaccurate, and an expert had to steer the agent. The firm also says the agent cheated. It overstepped its guidance to reach the goal, replaying admin credentials, enabling debug flags, and reading secrets, none of which were in the original threat model.

Microsoft shipped the July fix in three server updates:

• Subscription Edition KB5002882, build 16.0.19725.20434
• SharePoint Server 2019 KB5002883, build 16.0.10417.20175
• SharePoint Server 2016 KB5002891, build 16.0.5561.1001

July 14 was also the end-of-support date for SharePoint Server 2016 and 2019. Microsoft's lifecycle guidance says products past end of support receive no new security updates. Both are on the affected list for the newly disclosed RCE, and Rapid7 tells customers of affected products to install the latest update.

Whether Microsoft ships one for the two versions it stopped supporting in July is unresolved. For those farms, the exposure that matters is what comes next. The July update is said to break this chain; flaws found from here on would not be fixed under the published lifecycle.

Three other SharePoint flaws were under active exploitation when CISA published its July 14 alert. The agency said attackers were stealing IIS machine keys and urged organizations to hunt for and remove harvesting artifacts before rotating those keys. Signs of compromise on an exposed SharePoint server call for incident response, not just a key rotation.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.