SharePoint Auth Bypass and RCE Chain Actively Exploited After Public PoC Release

Two critical vulnerabilities in Microsoft SharePoint form an exploit chain that bypasses authentication entirely and leads to unauthenticated remote code execution. CVE-2026-55040, disclosed on 14 July 2026 as part of Microsoft's Patch Tuesday cycle, is a JWT token authentication bypass with a CVSS score of 9.1. This has been chained with CVE-2026-63520 (an RCE vulnerability also disclosed by Rapid7 and Microsoft) to achieve full system compromise without requiring valid credentials. The public availability of proof-of-concept code has already triggered active exploitation in the wild, indicating that threat actors have moved rapidly from disclosure to weaponisation.

The attack flow is significant because the first vulnerability alone is a feature bypass rather than a traditional implementation flaw. The JWT authentication mechanism in SharePoint contains a logic weakness that allows attackers to forge or manipulate authentication tokens, granting access that should be denied. When combined with the RCE vector in the second vulnerability, this creates a trivial path to complete system takeover. The fact that both flaws were disclosed simultaneously (with CVE-2026-55040 leading the chain) suggests Microsoft and Rapid7 attempted coordinated disclosure, but the public release of working PoC code has accelerated real-world exploitation beyond patch deployment timelines.

Organisations running unpatched or recently patched SharePoint instances remain at immediate risk. SharePoint deployments are common in enterprise environments and often hold sensitive data, making them attractive targets. The authentication bypass means attackers do not require stolen credentials, phishing success, or multi-factor authentication bypass. Defenders must assume that any SharePoint server exposed to the internet has been probed for this vulnerability. Patch status verification is urgent: organisations must confirm that all SharePoint servers received the July 2026 security updates. For systems that cannot be patched immediately, network segmentation and access controls should be tightened, and authentication logs should be monitored for signs of token manipulation or unusual access patterns.

The broader implication is that vulnerability chains targeting foundational authentication mechanisms in enterprise products create a compounding risk window. The period between public PoC availability and widespread patch deployment is typically weeks to months, during which attackers have near-guaranteed success. Rapid7's decision to publish technical analysis alongside the PoC appears to have been made with security research transparency in mind, but the practical effect is that exploitation is now commoditised. Organisations should treat this as a direct threat indicator and prioritise patching SharePoint systems ahead of other non-critical updates.