AI-agent-assisted SharePoint exploit chain — JWT auth bypass + unsafe deserialization RCE (CVE-2026-55040, CVE-2026-63520)

View raw markdownEdit on GitHub ↗

TL;DR

Rapid7 researchers used an AI coding agent to help find and chain two Microsoft SharePoint Server vulnerabilities into unauthenticated remote code execution — a JWT authentication-bypass (CVSS 9.1) feeding an unsafe-deserialization RCE (CVSS 8.1). The research itself is notable for this repo's audience less because of SharePoint specifically, and more because Rapid7 disclosed how the agent was used: 96 sessions, 256 prompts, ~80,000 agentic tool calls over 24 active days, with the agent replaying admin credentials and enabling debug flags during the work.

What happened

CVE-2026-55040 (CVSS 9.1) — a JWT authentication-bypass in SharePoint Server that lets an unauthenticated attacker assume the identity of any user, provided they know the target's Active Directory SID/UPN (Rapid7).

CVE-2026-63520 (CVSS 8.1) — unsafe .NET type instantiation in SharePoint's Business Connectivity Services, reachable once authenticated (including via the identity assumed through CVE-2026-55040), yielding unauthenticated remote code execution when chained (Rapid7).

Both affect SharePoint Server Subscription Edition, 2019, and 2016 (SharePoint Online is not affected). CISA issued a preliminary alert on 2026-07-14; Rapid7's full technical disclosure followed 2026-08-11 (The Hacker News). Both CVEs are now patched.

The chain was originally built as a Pwn2Own Berlin entry. Rapid7's disclosure states the research was built with heavy AI-agent assistance — 96 sessions, 256 prompts, and approximately 80,000 agentic tool calls across 24 active days of work — and that the agent, in the course of this research, replayed admin credentials, enabled debug flags, and read secrets. A full RCE technical write-up was promised within 30 days of the initial disclosure.

This is worth tracking alongside this repo's other "AI agent used for offensive security research at scale" entries (the Anthropic/OpenAI cyber-eval disclosures, JADEPUFFER, the UK AISI incident report) — not because SharePoint itself is a vibe-coding tool, but because it's a concrete, vendor-independent data point on how much agentic tool-call volume a single research engagement can now generate, and the kind of privileged actions (credential replay, debug-flag toggling) an assistant can take along the way even in a sanctioned bug-bounty context.

Am I affected?

  • If you run on-premises SharePoint Server 2016, 2019, or Subscription Edition, confirm you're on a patched build — check Microsoft's SharePoint update history for the August 2026 cumulative update that addresses CVE-2026-55040 and CVE-2026-63520.
  • SharePoint Online (Microsoft 365) tenants are not affected by either CVE.

If you are affected

→ playbooks/if-your-webapp-was-compromised.md

Prevention

→ prevention/agent-sandboxing.md → prevention/credential-hygiene.md

Update — 2026-08-18: CISA adds CVE-2026-55040 to the Known Exploited Vulnerabilities catalog

Confirmed directly in CISA's KEV feed (catalogVersion 2026.08.21): CVE-2026-55040, listed as "Microsoft SharePoint Weak Authentication Vulnerability", dateAdded 2026-08-18, with a dueDate of 2026-08-21 — a three-day federal remediation clock, which is CISA's signal for exploitation it considers urgent.

Only the JWT authentication-bypass half of the chain (CVE-2026-55040) is KEV-listed; the deserialization RCE (CVE-2026-63520) is not, as of this catalog version. That distinction matters less than it sounds: the auth bypass is what turns the chain from "authenticated attacker" into "anyone who knows a valid SID/UPN," and it is the half now confirmed exploited.

If you run on-premises SharePoint Server 2016 / 2019 / Subscription Edition and have not applied the July 2026 patches, this is no longer a theoretical Pwn2Own chain. SharePoint Online remains unaffected.

Sources