Active In-the-Wild Chaining of SharePoint Auth Bypass and BCS Flaws Enables Remote Code Execution
Threat actors are actively attempting to chain two critical Microsoft SharePoint vulnerabilities to achieve remote code execution on unpatched deployments. The initial stage relies on `CVE-2026-55040`, an authentication bypass situated within the server's JWT token validation pipeline. This bypass allows unauthenticated attackers to spoof actions as regular SharePoint site users or administrative accounts. Following this access, attackers pivot to `CVE-2026-63520`, a flaw located in the Business Connectivity Services component, which facilitates full remote code execution. Proof-of-concept exploits for both vulnerabilities were published independently during August. Rapid7 disclosed exploit code for the authentication bypass on August 11, which was weaponized within 24 hours. A separate researcher later released exploit material for the BCS vulnerability on August 24. Telemetry from Defused revealed active probing of this exact two-stage chain inside honeypot environments by late August. Probing activity included initial JWT manipulation followed by heavy administrative enumeration directed at the Business Data Catalog sink. Data from Shadowserver indicates over 8,700 SharePoint servers remain directly reachable from the public internet. CISA previously mandated federal agencies to mitigate the authentication bypass, while also noting that older SharePoint bugs like `CVE-2026-45659` are already being abused by ransomware operators.
Commentary
Public-facing SharePoint instances continue to be a primary vector for enterprise compromise. Chaining an authentication bypass directly into a Business Data Catalog sink provides attackers with a reliable remote code execution vector without needing pre-existing domain credentials. Organizations running on-premises SharePoint deployments should treat these endpoints as high-risk targets and ensure recent security updates are applied immediately. Where patching cannot be completed immediately, removing SharePoint services from direct internet exposure behind a VPN, zero-trust network access (ZTNA) solution, or reverse proxy with strict pre-authentication is the primary mitigation. Network defenders should also review IIS and SharePoint ULS logs for anomalies in JWT token parsing and unexpected enumeration attempts targeting Business Data Catalog endpoints.
The Quote to Remember
“We're seeing the SharePoint CVE-2026-55040 + CVE-2026-63520 RCE chain probed in our honeypots. The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520. No code execution observed yet.”