WARNING: Critical Microsoft SharePoint Exploit Chain Discovered
A critical vulnerability chain in Microsoft SharePoint is being actively exploited by attackers to bypass authentication and execute remote code. The exploit combines a JWT validation flaw with a Business Connectivity Services vulnerability, posing a significant risk to unpatched servers.
Why it matters
Organizations failing to apply the latest security updates are at high risk of full server compromise, which could lead to massive data breaches.
Attackers are actively probing internet-exposed Microsoft SharePoint servers for a newly documented vulnerability chain capable of bypassing authentication and delivering remote code execution, intensifying pressure on organisations that have not yet installed Microsoft’s July and August 2026 security updates.
The emerging activity combines two vulnerabilities: CVE-2026-55040 , a critical authentication bypass in SharePoint’s JSON Web Token validation process, and CVE-2026-63520 , a high-severity flaw in SharePoint Business Connectivity Services that can be abused to execute arbitrary code.
Although each vulnerability has a different technical purpose, their combined effect is significantly more dangerous. The first can allow an unauthenticated attacker to impersonate a legitimate SharePoint user or administrator. The second can then provide a path from that privileged SharePoint access to code execution on the underlying server.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in