#Exploit Chain

Active In-the-Wild Chaining of SharePoint Auth Bypass and BCS Flaws Enables Remote Code Execution

Threat actors are actively attempting to chain two critical Microsoft SharePoint vulnerabilities to achieve remote code execution on unpatched deployments. The initial stage relies on `CVE-2026-55040`, an authentication bypass situated within the server's JWT token validation pipeline. This bypass allows unauthenticated attackers to spoof actions as regular SharePoint site users or administrative accounts. Following this access, attackers pivot to `CVE-2026-63520`, a flaw located in the Business Connectivity Services component, which facilitates full remote code execution. Proof-of-concept exploits for both vulnerabilities were published independently during August. Rapid7 disclosed exploit code for the authentication bypass on August 11, which was weaponized within 24 hours. A separate researcher later released exploit material for the BCS vulnerability on August 24. Telemetry from Defused revealed active probing of this exact two-stage chain inside honeypot environments by late August. Probing activity included initial JWT manipulation followed by heavy administrative enumeration directed at the Business Data Catalog sink. Data from Shadowserver indicates over 8,700 SharePoint servers remain directly reachable from the public internet. CISA previously mandated federal agencies to mitigate the authentication bypass, while also noting that older SharePoint bugs like `CVE-2026-45659` are already being abused by ransomware operators.