--- id: 2026-08-sharepoint-ai-assisted-exploit-chain title: "AI-agent-assisted SharePoint exploit chain — JWT auth bypass + unsafe deserialization RCE (CVE-2026-55040, CVE-2026-63520)" date_disclosed: 2026-08-11 last_updated: 2026-08-21 severity: high status: patched ecosystems: [sharepoint, microsoft] tools_affected: [sharepoint-server] tags: [ai-agent-research, rce, auth-bypass, deserialization, pwn2own] --- ## TL;DR Rapid7 researchers used an AI coding agent to help find and chain two Microsoft SharePoint Server vulnerabilities into unauthenticated remote code execution — a JWT authentication-bypass (CVSS 9.1) feeding an unsafe-deserialization RCE (CVSS 8.1). The research itself is notable for this repo's audience less because of SharePoint specifically, and more because Rapid7 disclosed *how* the agent was used: 96 sessions, 256 prompts, ~80,000 agentic tool calls over 24 active days, with the agent replaying admin credentials and enabling debug flags during the work. ## What happened **CVE-2026-55040** (CVSS 9.1) — a JWT authentication-bypass in SharePoint Server that lets an unauthenticated attacker assume the identity of any user, provided they know the target's Active Directory SID/UPN ([Rapid7](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)). **CVE-2026-63520** (CVSS 8.1) — unsafe .NET type instantiation in SharePoint's Business Connectivity Services, reachable once authenticated (including via the identity assumed through CVE-2026-55040), yielding unauthenticated remote code execution when chained ([Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/)). Both affect **SharePoint Server Subscription Edition, 2019, and 2016** (SharePoint Online is not affected). CISA issued a preliminary alert on **2026-07-14**; Rapid7's full technical disclosure followed **2026-08-11** ([The Hacker News](https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html)). Both CVEs are now patched. The chain was originally built as a **Pwn2Own Berlin** entry. Rapid7's disclosure states the research was built with heavy AI-agent assistance — 96 sessions, 256 prompts, and approximately 80,000 agentic tool calls across 24 active days of work — and that the agent, in the course of this research, **replayed admin credentials, enabled debug flags, and read secrets**. A full RCE technical write-up was promised within 30 days of the initial disclosure. This is worth tracking alongside this repo's other "AI agent used for offensive security research at scale" entries (the Anthropic/OpenAI cyber-eval disclosures, JADEPUFFER, the UK AISI incident report) — not because SharePoint itself is a vibe-coding tool, but because it's a concrete, vendor-independent data point on how much agentic tool-call volume a single research engagement can now generate, and the kind of privileged actions (credential replay, debug-flag toggling) an assistant can take along the way even in a sanctioned bug-bounty context. ## Am I affected? - If you run on-premises **SharePoint Server 2016, 2019, or Subscription Edition**, confirm you're on a patched build — check Microsoft's SharePoint update history for the August 2026 cumulative update that addresses CVE-2026-55040 and CVE-2026-63520. - SharePoint Online (Microsoft 365) tenants are not affected by either CVE. ## If you are affected → [playbooks/if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md) ## Prevention → [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md) → [prevention/credential-hygiene.md](../prevention/credential-hygiene.md) ## Update — 2026-08-18: CISA adds CVE-2026-55040 to the Known Exploited Vulnerabilities catalog Confirmed directly in [CISA's KEV feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) (catalogVersion 2026.08.21): **CVE-2026-55040**, listed as "Microsoft SharePoint Weak Authentication Vulnerability", **`dateAdded` 2026-08-18**, with a **`dueDate` of 2026-08-21** — a three-day federal remediation clock, which is CISA's signal for exploitation it considers urgent. Only the JWT authentication-bypass half of the chain (CVE-2026-55040) is KEV-listed; the deserialization RCE (CVE-2026-63520) is not, as of this catalog version. That distinction matters less than it sounds: the auth bypass is what turns the chain from "authenticated attacker" into "anyone who knows a valid SID/UPN," and it is the half now confirmed exploited. If you run **on-premises SharePoint Server 2016 / 2019 / Subscription Edition** and have not applied the July 2026 patches, this is no longer a theoretical Pwn2Own chain. SharePoint Online remains unaffected. ## Sources - [The Hacker News — Researchers disclose AI-assisted SharePoint exploit chain](https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html) — AI-agent usage statistics, disclosure timeline. - [Rapid7 — CVE-2026-63520: Microsoft SharePoint Remote Code Execution (fixed)](https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/) — technical root cause, CVSS, affected versions. - [Rapid7 — CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (fixed)](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/) — technical root cause, CVSS, affected versions. - [CISA — Known Exploited Vulnerabilities catalog (JSON feed, catalogVersion 2026.08.21)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — added 2026-08-21, fetched directly: confirms CVE-2026-55040 KEV entry, dateAdded 2026-08-18, dueDate 2026-08-21.