Table of Contents
Introduction
Attackers are actively targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers. This is a critical threat for US businesses that rely on SharePoint for document management, collaboration, and business operations.
According to threat intelligence company Defused, threat actors are now chaining the SharePoint authentication bypass (CVE-2026-55040) and remote code execution (RCE) flaw (CVE-2026-63520) in attacks targeting honeypots. Both vulnerabilities have publicly available proof-of-concept (PoC) exploits, making them easy for attackers to weaponize.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already ordered federal agencies to secure their SharePoint servers against ongoing CVE-2026-55040 attacks.
The Two SharePoint Vulnerabilities
Vulnerability 1: CVE-2026-55040 — Authentication Bypass
- An authentication bypass flaw in the JWT token validation pipeline
- Attackers without privileges can exploit this to perform operations as a SharePoint site user or administrator
- PoC exploit released by Rapid7 researcher Stephen Fewer on August 11, 2026
- One day after the PoC was published, Defused reported it was already weaponized in attacks
Vulnerability 2: CVE-2026-63520 — Remote Code Execution (RCE)
- A vulnerability in SharePoint's Business Connectivity Services (BCS)
- Unauthenticated attackers can chain this after successfully exploiting CVE-2026-55040
- Enables remote code execution (RCE) on a targeted SharePoint Server
- PoC exploit released by VulnCheck researcher Jonathan Peterson on August 24, 2026
Microsoft has labeled CVE-2026-63520 as an "attractive target for threat actors." While it hasn't been officially tagged as exploited in the wild, the exploit chain is actively being probed.
How the Attack Works
According to Defused's analysis, the attack chain follows these steps:
- Authentication Bypass — Attackers exploit CVE-2026-55040 to bypass JWT token validation and gain unauthorized access as a SharePoint site user or administrator
- Admin Enumeration — Once authenticated, attackers perform heavy admin enumeration to identify privileged accounts and configurations
- Business Data Catalog Probing — Attackers probe the Business Data Catalog sink behind CVE-2026-63520
- Remote Code Execution — With the bypass and enumeration complete, attackers execute arbitrary code on the SharePoint server
"We're seeing the SharePoint CVE-2026-55040 + CVE-2026-63520 RCE chain probed in our honeypots," Defused warned on Tuesday.
Why This Matters for US Businesses
US organizations are at significant risk from these SharePoint vulnerabilities:
- Widespread SharePoint adoption — SharePoint is used by millions of US businesses for document management, intranets, and collaboration
- Government and defense contractors — US federal agencies and defense contractors are prime targets for nation-state actors
- Ransomware threat — CISA has confirmed that SharePoint vulnerabilities are being exploited in ransomware attacks
- Data exposure — SharePoint servers often contain sensitive business data, financial records, and intellectual property
- Critical infrastructure — Many US critical infrastructure organizations rely on SharePoint for operations
Since November 2021, CISA has flagged 15 actively exploited Microsoft SharePoint flaws, eight of them also exploited by ransomware gangs.
CISA Warning: Federal Agencies Ordered to Act
On August 18, 2026, CISA ordered federal agencies and network defenders to secure their SharePoint servers against ongoing CVE-2026-55040 attacks.
CISA's key recommendations:
- Review Microsoft's official SharePoint Server security-hardening guidance
- Avoid directly exposing SharePoint servers on the Internet unless absolutely necessary
- Apply patches immediately for CVE-2026-55040 and CVE-2026-63520
- Monitor for indicators of compromise (IOCs) related to SharePoint exploitation
On July 15, 2026, CISA warned network defenders to secure their servers against attackers actively exploiting three SharePoint vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164).
SharePoint Exposure Statistics
The Internet security non-profit Shadowserver now tracks more than 8,700 Microsoft SharePoint servers exposed online. This includes:
- US-based servers — a significant portion of these exposed servers are in the United States
- Government and enterprise servers — many are operated by government agencies and large enterprises
- Honeypots vs. real targets — while some are honeypots, many are legitimate servers vulnerable to attack
8,700+ SharePoint servers are exposed online — each one is a potential target for attackers exploiting this RCE chain.
How to Protect Your SharePoint Servers
US IT administrators should take these immediate steps to secure their SharePoint infrastructure:
1. Apply Patches Immediately
- Patch CVE-2026-55040 (authentication bypass)
- Patch CVE-2026-63520 (remote code execution)
- Also patch CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 (actively exploited since July)
- Microsoft has released security updates for all these vulnerabilities
2. Review Security-Hardening Guidance
- Review Microsoft's official SharePoint Server security-hardening guidance
- Implement recommended configurations and best practices
- Disable unnecessary services and features
3. Restrict Internet Exposure
- Avoid directly exposing SharePoint servers on the Internet unless necessary
- Use VPNs, reverse proxies, or Azure Application Proxy for remote access
- Implement network segmentation to isolate SharePoint servers
4. Monitor for Indicators of Compromise
- Monitor logs for unusual JWT token validation failures
- Watch for unexpected admin account activity
- Look for Business Data Catalog enumeration patterns
- Implement SIEM alerts for SharePoint exploitation attempts
5. Implement Zero Trust Security
- Use multi-factor authentication (MFA) for all SharePoint access
- Implement conditional access policies
- Apply least privilege principles to SharePoint permissions
Taking these steps immediately can protect your US business from the ongoing SharePoint exploitation campaign.
Ransomware Gangs Are Exploiting SharePoint
CISA has confirmed that CVE-2026-45659, a SharePoint remote code execution vulnerability flagged as exploited in the wild since early July, is now also being exploited in ransomware attacks.
Key statistics:
- 15 actively exploited Microsoft SharePoint flaws flagged by CISA since November 2021
- 8 of these flaws have been exploited by ransomware gangs
- Ransomware groups are increasingly targeting SharePoint as an entry point for enterprise networks
The average cost of a ransomware attack on a US business exceeded $4.5 million in 2026. SharePoint vulnerabilities are a primary entry point.
Final Thoughts
The active exploitation of the SharePoint RCE chain (CVE-2026-55040 + CVE-2026-63520) represents a significant threat to US businesses. With public PoC exploits available and attackers already probing vulnerable systems, the window to secure SharePoint servers is closing rapidly.
Key takeaways for US organizations:
- Two SharePoint vulnerabilities (CVE-2026-55040 and CVE-2026-63520) are being chained for RCE
- Public PoC exploits are available, making weaponization easy
- CISA has ordered federal agencies to secure their SharePoint servers
- 8,700+ SharePoint servers are exposed online worldwide
- Ransomware gangs are actively exploiting SharePoint vulnerabilities
- Patch immediately and restrict Internet exposure
If you need help securing your SharePoint infrastructure or want to learn more about protecting your US business from cyber threats, contact SystemLogicIT for a free security assessment.