Key Takeaways

  • Attackers are testing a chain combining CVE-2026-55040 with CVE-2026-63520 against on-premises Microsoft SharePoint servers.
  • Public proof-of-concept code appears to have shortened the gap between vulnerability disclosure and hostile activity.
  • Organizations should prioritize patching, reduce direct internet exposure, and investigate potentially compromised SharePoint systems.

Attackers are probing Microsoft SharePoint servers with a two-stage exploit chain that could lead to unauthenticated remote code execution on unpatched systems, according to threat intelligence provider Defused.

The activity combines CVE-2026-55040, an authentication bypass in SharePoint's JWT token validation pipeline, with CVE-2026-63520, a flaw affecting Business Connectivity Services. The first vulnerability can let an attacker operate as a SharePoint site user or administrator. That access can then be used to reach the second vulnerability and potentially execute arbitrary code on the server.

Defused said on August 25 that its honeypots recorded exploitation of the JWT bypass, followed by extensive administrator enumeration and probing of the Business Data Catalog component associated with CVE-2026-63520. The company had not observed successful code execution at the time of its report.

That distinction matters. Probing does not confirm that every attempt succeeded, but it shows that attackers are actively assembling and testing the complete chain rather than treating the two vulnerabilities as isolated weaknesses.

Public exploit code is accelerating that process. A Rapid7 security researcher released a proof of concept for CVE-2026-55040 on August 11. Defused reported weaponized activity one day later. A VulnCheck vulnerability researcher then published proof-of-concept work for CVE-2026-63520 on August 24, giving attackers public material covering the second stage.

Defenders are no longer working with a long disclosure-to-exploitation window. In this case, the first proof of concept was reportedly adapted for attacks within roughly 24 hours. How many enterprises can inventory, test, approve, and deploy an emergency SharePoint update that quickly?

The exposed population is substantial. Shadowserver tracks more than 8,700 Microsoft SharePoint servers reachable from the internet. That figure includes systems whose patch status is unknown and may also include honeypots, so it should not be read as a count of vulnerable installations. It does, however, illustrate the breadth of the potential scanning surface.

Microsoft has described CVE-2026-63520 as an attractive target for attackers, although it had not labeled the vulnerability as exploited in the wild as of August 26. The observed chaining activity puts added pressure on administrators to treat that distinction cautiously. Attackers can probe and prepare infrastructure before defenders receive confirmation of successful exploitation.

The campaign also fits a wider pattern. On July 15, the Cybersecurity and Infrastructure Security Agency warned about active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 against internet-exposed on-premises SharePoint Server instances. CISA subsequently directed federal agencies and network defenders on August 18 to secure servers against ongoing CVE-2026-55040 attacks. On August 25, it confirmed that CVE-2026-45659 was also being used in ransomware attacks.

Since November 2021, CISA has flagged 15 actively exploited Microsoft SharePoint vulnerabilities, eight of which were also used by ransomware groups. The 2025 ToolShell chain, involving CVE-2025-49706 and CVE-2025-49704, offered another warning about how rapidly public research can be converted into mass exploitation.

For security teams, patching is the immediate priority, but it is only part of the response. Administrators should review Microsoft's SharePoint Server hardening guidance, restrict direct internet access where feasible, and place high-value collaboration systems behind tightly controlled access layers. NIST SP 800-207 zero-trust principles can help shape that architecture through stronger identity verification, segmentation, and narrowly scoped access.

Organizations with exposed or previously unpatched servers should also investigate rather than assuming an update resolves every concern. Authentication anomalies, administrator enumeration, unexpected Business Data Catalog activity, suspicious child processes, altered files, and signs of stolen IIS machine keys can warrant closer review. SharePoint often holds sensitive documents and trusted connections to other business systems. Once compromised, it can become more than an entry point. It can become a durable platform for persistence, credential theft, and ransomware deployment.