Hackers Target Microsoft SharePoint RCE Chain With PoC Exploit

Overview

Attackers are now actively targeting a chain of two Microsoft SharePoint vulnerabilities that, combined, allow arbitrary code execution on unpatched, internet-facing servers. Threat intelligence firm Defused reported observing the chain being probed in its honeypots as of August 25, 2026, following the public release of proof-of-concept exploits for both flaws.

Technical Details

How the Chain Works

The attack unfolds in two stages. First, attackers exploit CVE-2026-55040, a flaw in SharePoint's JWT token validation pipeline that lets an unprivileged, unauthenticated attacker obtain a token that the server treats as belonging to a legitimate site user — or in some cases, an administrator. With that elevated context in hand, attackers chain into CVE-2026-63520, a vulnerability in SharePoint's Business Connectivity Services, to achieve remote code execution without ever supplying valid credentials.

Defused described the observed activity directly: "The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink." That sequence — authentication bypass, followed by enumeration of administrative surface, followed by probing of the BCS execution sink — matches the two-stage chain exactly.

Exploitation Status

As of publication, Microsoft has not tagged CVE-2026-63520 as exploited in the wild in its own advisory, but Defused's honeypot telemetry indicates the chain is being actively probed by outside parties, not merely tested by researchers. With working public proof-of-concept code available since August 24, the gap between "probed" and "widely exploited" is expected to be short — this pattern has repeated with prior SharePoint RCE chains, most notably the ToolShell exploitation wave.

No specific threat actor or group has been publicly attributed to the current probing activity.

Who Should Act Now

• Any organization running on-premises SharePoint Server exposed directly to the internet
• IT teams that have not applied the latest SharePoint security updates addressing CVE-2026-55040 and CVE-2026-63520
• Security teams monitoring perimeter assets, who should treat SharePoint servers with internet exposure as high-priority scan targets

Mitigation

1. Apply the latest Microsoft SharePoint security updates covering both CVE-2026-55040 and CVE-2026-63520 without delay.
2. Avoid exposing SharePoint servers directly to the internet — CISA's standing guidance is to place on-premises SharePoint behind a VPN, reverse proxy, or other access-restricting layer rather than publishing it directly.
3. Review Microsoft's SharePoint security-hardening guidance for AMSI integration, Machine Key rotation, and other defense-in-depth controls that reduce the blast radius of a JWT-validation bypass.
4. Hunt for indicators of the two-stage chain in logs — unexpected admin-level API calls following anomalous token validation, and probing of Business Data Catalog / BCS endpoints.
5. Rotate SharePoint machine keys if compromise is suspected, since a successful JWT bypass can be replayed until keys are rotated.

Sources

• BleepingComputer — Hackers target Microsoft SharePoint RCE chain with PoC exploit