AI-Assisted Discovery Uncovers Critical SharePoint Exploit Chain (CVE-2026-55040 & CVE-2026-63520) Achieving Unauthenticated Remote Code Execution
Executive Summary
On August 11, 2026, security researchers at Rapid7 alongside Microsoft disclosed a critical, AI-discovered vulnerability chain impacting on-premises Microsoft SharePoint Server installations. By combining two distinct flaws—an identity spoofing vulnerability (CVE-2026-55040) and an unsafe .NET type instantiation bug (CVE-2026-63520)—unauthenticated remote attackers can bypass perimeter security controls, spoof arbitrary user credentials, and achieve full Remote Code Execution (RCE) on farm servers.
The discovery highlights an accelerating trend in vulnerability research: autonomous AI agents identifying complex multi-stage attack paths across legacy enterprise codebases. All organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition are urged to deploy the August 11, 2026 security updates and complete database configuration upgrades immediately (The Hacker News).
Deep-Dive Technical Analysis
The Exploit Chain: From Identity Spoofing to Code Execution
The attack path leverages two vulnerabilities that, in isolation, present severe risks but together yield complete, unauthenticated server compromise:
1. CVE-2026-55040: Pre-Authentication Identity Spoofing (CVSS 9.1)
The initial entry point stems from a flaw in SharePoint's claim-based authentication handler. When processing incoming web requests to specific endpoints, the handler fails to validate token signatures against trusted Active Directory domain controllers if specific header fields containing a target user's Security Identifier (SID) or User Principal Name (UPN) are provided (The Hacker News).
An unauthenticated attacker on the network can supply the SID or UPN of an administrative account (such as a Site Collection Administrator or Farm Admin). The server accepts the unverified claim, instantiating a privileged security context for the request without requiring valid credentials or multi-factor authentication (The Hacker News).
2. CVE-2026-63520: Unsafe .NET Type Instantiation in BCS (CVSS 8.1)
Once the attacker assumes a privileged identity context via CVE-2026-55040, they target SharePoint's Business Connectivity Services (BCS) component. BCS allows SharePoint to integrate external data sources via LobSystem definitions and XML model files (The Hacker News).
When parsing a user-supplied BDC/BCS model package, the service processes serialized .NET metadata objects without enforcing strict type filtering. By submitting a crafted XML payload referencing gadget classes within the .NET Framework (such as System.Diagnostics.Process or ObjectStateFormatter), the attacker forces the underlying IIS worker process (w3wp.exe) to instantiate arbitrary types and execute arbitrary system commands under the context of the SharePoint farm service account (The Hacker News).
Chaining Mechanics
Step
Action
Outcome
1
Spoofing
Attacker crafts HTTP request with forged UPN/SID headers targeting BCS endpoints (CVE-2026-55040).
2
Bypass
SharePoint accepts the forged identity, elevating the session to Site Collection Administrator.
3
Injection
Elevated session uploads a malicious BCS model package with serialized .NET gadgets (CVE-2026-63520).
4
RCE
BCS deserializes the payload, executing shell commands with farm service account privileges.
The Role of AI in Vulnerability Discovery
Rapid7 and Microsoft noted that the discovery of this exploit chain was significantly accelerated using specialized AI auditing agents (The Hacker News). AI models trained on .NET static analysis and ASP.NET request lifecycle routines systematically mapped parameter flow paths across legacy SharePoint assemblies, identifying the exact combination of claim validation gaps and BDC deserialization sinks.
This disclosure underscores the narrowing window between vulnerability discovery and weaponization as AI tools lower the barrier for mapping complex, multi-component attack surfaces in enterprise software (The Hacker News).
Industry Impact & Threat Scope
On-premises SharePoint instances remain central collaboration and document storage hubs for government agencies, healthcare networks, and enterprise organizations. Unauthenticated RCE on a SharePoint server provides threat actors with immediate access to confidential corporate documents, Active Directory domain credentials, and internal network pivots (The Hacker News).
Affected Versions:
* Microsoft SharePoint Server Subscription Edition
* Microsoft SharePoint Server 2019
* Microsoft SharePoint Enterprise Server 2016
Actionable Mitigations Playbook
Security teams operating on-premises SharePoint deployments must take immediate action:
1. Apply August 11, 2026 Security Updates: Install official Microsoft Cumulative Updates (CUs) for SharePoint Server Subscription Edition, 2019, and 2016 (The Hacker News).
2. Execute PSConfig: Installing binary updates alone is insufficient. Administrators MUST run the SharePoint Products Configuration Wizard (psconfig.exe -cmd setup -cmd upgrade) across all farm nodes to apply database schema fixes and patch the BCS service (The Hacker News).
3. Audit BCS Endpoints: Review IIS logs for anomalous POST requests to Business Connectivity Services (/_vti_bin/BdcDataService.svc) and inspect uploaded BDC models for unauthorized .NET type definitions.
4. Restrict Network Perimeter Exposure: Isolate SharePoint web front-ends behind Zero Trust Network Access (ZTNA) or Web Application Firewalls (WAFs) configured to block unverified claim headers.
5. Rotate Service Account Credentials: As a precautionary measure, rotate the passwords of the SharePoint farm service account and IIS application pool identities.
For further technical details, refer to The Hacker News Security Coverage.
Reported by: Person