SharePoint RCE Flaws Targeted in Honeypot Probes After PoC Releases
Summary
Defused reported probes chaining two SharePoint flaws in honeypots, but observed no code execution. Both have public PoCs; CISA has urged defenders to secure SharePoint servers.
Key points
- CVE-2026-55040 is an authentication bypass in SharePoint’s JWT token validation pipeline.
- Unauthenticated attackers can reportedly chain CVE-2026-63520, affecting Business Connectivity Services, for remote code execution after exploiting CVE-2026-55040.
- Public PoCs for the two flaws were released by Stephen Fewer and Jonathan Peterson.
- Defused reported the first PoC had been weaponized and later observed the chained flaws being probed in honeypots; it said no code execution was observed.
- Shadowserver tracks more than 8,700 internet-exposed SharePoint servers, but the article gives no count of systems vulnerable to these flaws.
- CISA urged defenders to secure SharePoint servers. Microsoft had not labeled CVE-2026-63520 as exploited in the wild.
Article Details
- Vulnerability Types
- Authentication bypass in the JWT token validation pipeline
- Business Connectivity Services vulnerability enabling remote code execution when chained with CVE-2026-55040
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unknown
- Workarounds
- Avoid directly exposing SharePoint servers to the Internet unless necessary.
MITRE ATT&CK
CVE
CVE-2026-55040Attackers are chaining CVE-2026-55040 and CVE-2026-63520 to target unpatched Microsoft SharePoint servers for remote code execution, with Defused reporting active probing in honeypots.CVE-2026-63520Attackers are chaining CVE-2026-55040 and CVE-2026-63520 to target unpatched Microsoft SharePoint servers for remote code execution, with Defused reporting active probing in honeypots.