As reported by BleepingComputer, threat actors are now actively probing a two-vulnerability chain targeting Microsoft SharePoint Server on-premises deployments. What makes this situation particularly urgent is the convergence of three accelerating factors: public proof-of-concept code for both links in the chain, confirmed active exploitation of the first vulnerability, and over 8,700 internet-exposed SharePoint instances still visible to scanners.
This is not a theoretical risk anymore. The window between PoC publication and mass exploitation has collapsed to days, not weeks.
Vulnerability Chain Summary
| CVE | Type | Severity | PoC Available | Exploited in Wild |
|---|---|---|---|---|
| CVE-2026-55040 | JWT authentication bypass in SharePoint token validation pipeline | High/Critical | Yes (Rapid7, Aug 11) | Yes — CISA confirmed, added to patch directive Aug 18 |
| CVE-2026-63520 | RCE via Business Connectivity Services (BCS) / Business Data Catalog | Critical | Yes (VulnCheck, Aug 24) | Microsoft not yet tagged; Defused reports honeypot probing of the BCS sink |
Affected products: Microsoft SharePoint Server (on-premises). Cloud SharePoint Online is not affected by this chain.
Patch status: Microsoft has released security updates. Defenders should consult Microsoft's SharePoint Server security-hardening guidance and the relevant KB articles for their version.
Why This Chain Is Dangerous
The architectural problem here is that CVE-2026-55040 is an authentication bypass, not merely a privilege escalation. That means the attacker does not need credentials or an initial foothold — they arrive unauthenticated and depart with site-administrator context. Once that bypass is achieved, CVE-2026-63520 becomes a straightforward RCE primitive through the Business Connectivity Services component, which has historically been a soft target in SharePoint hardening guides.
The combination of unauthenticated access followed by code execution on a content-rich collaboration platform is about as bad as it gets for enterprise exposure.
SharePoint servers are particularly attractive targets because they sit at the intersection of identity, document storage, and internal trust. A compromised SharePoint server often yields Active Directory credentials, sensitive documents, and a launchpad for lateral movement into file shares and intranet applications.
Who Is Most at Risk
Shield53 Recommendations — Immediate Actions
- Patch now. Apply the latest SharePoint Server cumulative updates covering both CVE-2026-55040 and CVE-2026-63520. Prioritize any server with a public IP.
- Remove internet exposure. SharePoint Server was never designed to be internet-facing. Place it behind a VPN, Azure Application Proxy, or reverse proxy with strong authentication. This single change eliminates the majority of risk.
- Disable BCS if unused. If Business Connectivity Services and external data sources are not required, disable the BDC feature at the farm and web application level to neutralize CVE-2026-63520.
- Hunt for indicators. Review IIS and SharePoint ULS logs for anomalous JWT token patterns, unexpected admin enumeration activity, and requests targeting
/BDCor Business Data Catalog endpoints from untrusted IPs. - Review July advisories too. CISA's July 15 warning about CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 means some SharePoint farms may still be vulnerable to a third set of actively exploited flaws. Patch holistically, not reactively.
- Assume compromise for exposed, unpatched systems. If a server was internet-facing and unpatched since early August, initiate incident response procedures — do not simply patch and move on.
The broader lesson is familiar but bears repeating: on-premises collaboration platforms should never be directly internet-exposed. Every SharePoint server reachable on a public IP is a standing invitation for exactly this kind of chained exploitation. The patch matters, but the architecture matters more.
