Vulnerability Description
CVE-2026-55040 is an authentication bypass in the JWT handler used by Microsoft SharePoint Server. Several security settings, including RequireSignedTokens, are disabled by default, and together they let an attacker bypass SharePoint’s token validation entirely. An unauthenticated attacker who knows a target user’s security identifier (SID) or user principal name (UPN, typically user@domain) can forge a JWT and authenticate as that user — including a privileged administrator.
CVE-2026-63520 is a remote code execution vulnerability in SharePoint’s Business Connectivity Services (BCS), reachable without authentication once an attacker has exploited CVE-2026-55040. BCS is meant to load only types on an explicit allow list (BCSAllowedTypeNames), but before the patch an attacker could supply an arbitrary class name. VulnCheck found that instantiating System.Web.UI.LosFormatter creates a deserialization gadget that leads to remote code execution.
On August 11, 2026, Stephen Fewer of Rapid7 published a detailed disclosure on CVE-2026-55040 and CVE-2026-63520. On August 24, 2026, VulnCheck released a blog demonstrating how the two issues could be chained together to execute arbitrary code on a SharePoint server as an unauthenticated user.
Map of all Microsoft SharePoint Server hosts
| Field | Description |
|---|---|
| CVE-ID | CVE-2026-55040 — CVSS v3.1 9.1 (critical) — assigned by Microsoft CVE-2026-63520 — CVSS v3.1 8.1 (high) — assigned by Microsoft |
| Vulnerability Description | CVE-2026-55040 is an authentication bypass in SharePoint’s JWT handler that lets an unauthenticated attacker who knows a target’s SID or UPN forge a token and impersonate any user, including administrators. CVE-2026-63520 is a remote code execution flaw in SharePoint’s Business Connectivity Services, where an unvalidated, attacker-controlled type name lets a malicious BDC model instantiate a deserialization gadget. Chained, the two flaws enable unauthenticated RCE against a vulnerable SharePoint server. |
| Date of Disclosure | CVE-2026-55040: July 14, 2026 CVE-2026-63520: August 11, 2026 |
| Affected Assets | Microsoft SharePoint Server (on-premises editions): SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online (Microsoft 365) is not affected and requires no action. |
| Vulnerable Software Versions | CVE-2026-55040: SharePoint Server Subscription Edition prior to build 16.0.19725.20434; SharePoint Server 2019 prior to build 16.0.10417.20175; SharePoint Enterprise Server 2016 prior to build 16.0.5561.1001. CVE-2026-63520: SharePoint Server Subscription Edition prior to build 16.0.19725.20522; SharePoint Server 2019 prior to build 16.0.10417.20198; SharePoint Enterprise Server 2016 prior to build 16.0.5565.1001. |
| PoC Available | Yes. A full, working, weaponized exploit chaining both vulnerabilities is publicly available via VulnCheck. |
| Exploitation Status | CVE-2026-55040 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, confirming active exploitation. |
| Patch Status | Microsoft has published patches for all affected versions. CVE-2026-55040: SharePoint Server Subscription Edition build 16.0.19725.20434 (KB5002882); SharePoint Server 2019 build 16.0.10417.20175 (KB5002883); SharePoint Enterprise Server 2016 build 16.0.5561.1001 (KB5002891). CVE-2026-63520: SharePoint Server Subscription Edition build 16.0.19725.20522 (KB5002893); SharePoint Server 2019 build 16.0.10417.20198 (KB5002894, KB5002896); SharePoint Enterprise Server 2016 build 16.0.5565.1001 (KB5002905, KB5002906). |
Censys ARC Perspective
As of August 25, 2026, Censys observes approximately 329,000 SharePoint instances, of which approximately 21,000 are on-premises deployments that expose version numbers.
SharePoint is common and widely deployed, making this a potentially serious exposure. Organizations should patch as quickly as possible.
Censys queries:
host.services.software: (vendor: "microsoft" and product: "sharepoint_server") or web.software: (vendor: "microsoft" and product: "sharepoint_server")
host.services: (software: (vendor: "Microsoft" and product: "SharePoint")) or web_entity.instances.http.response.headers:(key:"MicrosoftSharePointTeamServices")
services: (software: (vendor: "Microsoft" and product: "SharePoint"))
References
- Microsoft Security Update Guide: CVE-2026-55040
- Microsoft Security Update Guide: CVE-2026-63520
- NVD – CVE-2026-55040
- NVD – CVE-2026-63520
- Rapid7 – Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
- Rapid7 – Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
- VulnCheck – Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain
- CISA Known Exploited Vulnerabilities Catalog – CVE-2026-55040