A piece of research dropped yesterday that every organization running on-premises Microsoft SharePoint needs to read.
Rapid7's senior principal security researcher Stephen Fewer published the full technical write-up and working proof-of-concept for CVE-2026-55040 — a critical JWT token authentication bypass (CVSS 9.1) that lets a remote, unauthenticated attacker impersonate any SharePoint user, including site administrators. At the same time, Rapid7 and Microsoft disclosed CVE-2026-63520 — a high-severity remote code execution flaw buried inside SharePoint's Business Connectivity Services component.
Chain them together: full unauthenticated remote code execution on any unpatched SharePoint server. No credentials. No account. Nothing.
Patches have been available since July 14 Patch Tuesday. The proof-of-concept just became public. You know what that means.
How It Was Found — and Why That Part Matters
This started as a competition entry for Pwn2Own Berlin. The entry didn't win, but Rapid7 kept the research going and turned it into a coordinated disclosure with Microsoft.
What makes this more than just another CVE: the vulnerability chain was found with significant AI assistance. Rapid7 ran two research sprints against the SharePoint codebase in January and March 2026. January produced nothing useful. March produced the chain.
The numbers they published in their technical analysis: 96 sessions, 256 prompts, roughly 80,000 tool calls, across 24 active days of agentic work.
The AI didn't do this on its own. Rapid7 is clear about that — a fully automated approach would have failed because the model produced too many inaccurate or questionable findings without an expert in the loop to steer it. But with a skilled researcher driving, the agent compressed the kind of multi-step code analysis that would have taken months into something much more tractable.
This is the pattern we're going to keep seeing. AI as a force multiplier for security research. Faster discovery of subtle, multi-step vulnerability chains. And the same capability, eventually, in the hands of attackers who aren't publishing blog posts about their methods.
Who's at Risk
On-premises SharePoint — Server 2016, 2019, and Subscription Edition — is the attack surface here. If your organization uses SharePoint Online through Microsoft 365, you're not exposed. Microsoft handles patching on the cloud side.
The problem is that on-prem deployments are disproportionately common in exactly the sectors CivSafe works with: government agencies, nonprofits, and public institutions. Organizations that chose on-prem for data residency reasons, procurement constraints, or because they inherited infrastructure from a decade ago. The same organizations that tend to have the slowest patch cycles — not because their IT teams are incompetent, but because patching a production SharePoint server requires testing, change approval, and scheduled maintenance windows that don't move at the speed of threat disclosure.
CISA has been warning about SharePoint exploitation since at least April. They've added five separate SharePoint CVEs to their Known Exploited Vulnerabilities catalog over the past several months — including CVE-2026-56164 and CVE-2026-58644, both confirmed actively exploited in the wild. Federal agencies were told to patch by July 4 and July 17 deadlines. Many haven't.
Now the full technical details and a working exploit for a more severe vulnerability chain are public. The time between "proof-of-concept published" and "this being scanned for in the wild" is typically measured in hours to a few days.
Industry data puts it plainly: 60% of breach victims were hit through a known vulnerability where a patch existed but hadn't been applied. That statistic sits right on top of the organizations that are most exposed to this chain.
What to Do Right Now
Step one: Figure out which type of SharePoint you're running. Open your browser, go to a SharePoint page, click the gear icon, and look at Site Settings. If your URL is *.sharepoint.com, you're on SharePoint Online. You're fine. Stop reading and go back to your day.
If you're on SharePoint Server — your URL is an internal domain or a self-hosted address — you need to check whether July 2026 Patch Tuesday updates are applied. The patches for both CVE-2026-55040 and CVE-2026-63520 are in the same cumulative update released July 14. You can check your SharePoint Server build in Central Administration under Upgrade and Migration.
If you can't patch immediately — and there are real reasons why some organizations can't — your short-term moves are:
- Block inbound access to SharePoint from untrusted networks at the firewall or reverse proxy level
- Turn on detailed IIS logging for your SharePoint sites and watch for authentication anomalies
- Audit any sites with Business Connectivity Services configured — that's the component CVE-2026-63520 targets and it's not universally deployed
Longer term: this is a good forcing function for a real conversation about on-premises versus cloud. The compliance and data residency arguments that justified on-prem SharePoint five years ago are mostly addressable with SharePoint Online's current sovereignty and residency options. Every on-prem SharePoint is an ongoing maintenance liability — and the rate at which that liability grows is accelerating as AI-assisted vulnerability research shortens the discovery-to-disclosure cycle.
The Pattern Worth Watching
What changed yesterday isn't just one new vulnerability pair. It's another data point in a trend that's been building for 18 months.
Security researchers are using AI agents to find complex, multi-step vulnerabilities faster than manual review ever could. What took Rapid7 a skilled researcher and 24 days of AI-augmented work in March will be faster next year, and faster still the year after. The attack surface isn't getting smaller.
Defenders need patch pipelines that move faster than they did in 2022. That doesn't mean chaos — it means having a process that can actually respond when something this critical lands on a Tuesday and exploitation starts on Thursday.
This is exactly the kind of operational risk we help organizations get ahead of. If you're running on-premises infrastructure and you're not sure where your exposure sits, that's worth a conversation before the next disclosure cycle.