Two Microsoft SharePoint Flaws Can Be Chained to Hack Servers Without a Password

Two serious Microsoft SharePoint Server vulnerabilities can be chained to let remote attackers take control of vulnerable servers without a password. The attack combines an authentication bypass tracked as 78 with a remote code execution flaw, CVE-2026-63520.

CVE-2026-55040, rated 9.1 out of 10 under CVSS v3.1, affects SharePoint’s JSON Web Token, or JWT, authentication handler.

The flaw allows an unauthenticated attacker to forge a token and impersonate a SharePoint user if they know that user’s security identifier or user principal name, such as user@domain. The issue exists because multiple JWT security checks in SharePoint’s token validation process were disabled or insufficient.

Rapid7 researchers found that the RequireSignedTokens setting was false, allowing SharePoint to accept an unsigned outer JWT. The affected code also failed to properly verify signatures for an embedded actor token in some cases.

An attacker can use the bypass to authenticate as a SharePoint administrator and access endpoints that normally require a valid login.

This changes the threat from a simple authentication weakness into a useful entry point for further attacks. Rapid7 disclosed CVE-2026-55040 on August 11, 2026, after the vulnerability was initially disclosed on July 14.

The second vulnerability, CVE-2026-63520, is a high-severity remote code execution flaw with a CVSS score of 8.1. It affects Business Connectivity Services, or BCS, a SharePoint component used to connect external data systems and .NET applications to SharePoint.

SharePoint Flaws Chained to Hack Servers

Before Microsoft’s patch, BCS did not properly restrict the .NET types that could be loaded from a Business Data Connectivity model. An attacker who has already bypassed authentication can submit a malicious BDC model that specifies an unsafe class.

VulnCheck researchers found that the System.Web. UI.LosFormatter class could be abused as a deserialization gadget, allowing arbitrary code to run on the SharePoint server.

In the complete attack chain, a threat actor first forges a JWT using CVE-2026-55040 and impersonates a privileged SharePoint account.

The attacker then obtains a form digest value, uploads a malicious BDC model, creates an external list, and triggers the vulnerable BCS processing path. This results in code execution in the SharePoint server environment.

DefusedCyber stated on X that VulnCheck released details of the vulnerability chain on August 24, 2026, including a working exploit and detection materials for its customers.

The company noted that a significant number of SharePoint deployments are exposed to the public internet. While Censys data cited in the disclosure identified about 21,000 on-premises instances exposing version details. SharePoint Online in Microsoft 365 is not affected.

Microsoft has released security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Organizations should install the latest August updates immediately, prioritize internet-facing SharePoint servers, and investigate unusual bearer-token authentication, unexpected BDC model uploads, and requests to Business Data Catalog endpoints.

CVE-2026-55040 was added to CISA’s Known Exploited Vulnerabilities catalog on August 18, indicating that attackers were already exploiting the authentication bypass.

Administrators should treat unpatched on-premises SharePoint servers as high-risk systems, especially where they are externally accessible.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Two Microsoft SharePoint Flaws Can Be Chained to Hack Servers Without a Password appeared first on Cyber Security News.