Rapid7 finishes its SharePoint chain, and publishes the PoC for the first link the same day

Rapid7 and Microsoft have disclosed CVE-2026-63520, a remote code execution flaw caused by unsafe .NET type instantiation in SharePoint's Business Connectivity Services, which runs attacker code with the privileges of the SharePoint site's service account ^[2][4]. It is the second half of a chain whose first half, the JWT authentication bypass CVE-2026-55040, received a full technical analysis and an accompanying proof-of-concept script from Rapid7 on the same day ^[10][11][1].

The RCE affects all supported versions of Microsoft SharePoint, plus certain versions of Microsoft Project Server and Microsoft Office Web Apps Server ^[3]. On its own it carries a CVSSv3.1 score of 8.1 (High) and is classified as CWE-20, improper input validation ^[5]. Rapid7 says that chained with CVE-2026-55040 it becomes part of a critical unauthenticated RCE chain ^[6]. Rapid7's post title marks CVE-2026-63520 as fixed ^[8].

The first link is the interesting one for defenders. Disclosed by Rapid7 and Microsoft on July 14, 2026, CVE-2026-55040 lets a remote unauthenticated attacker bypass authentication and act as a SharePoint site user or administrator, through several issues in the JWT token validation pipeline ^[10][12]. Rapid7 describes the root cause as a chain of four distinct weaknesses that together allow an attacker to forge a valid JWT and impersonate any SharePoint site user ^[13]. The analysis was done against SharePoint Server Subscription Edition 16.0.19725.20210, by decompiling and reviewing Microsoft.SharePoint.IdentityModel from a fully patched instance ^[14]. The affected code sits in SPJsonWebSecurityTokenHandlerV2 and its base class SPJsonWebSecurityBaseTokenHandlerV2, which parse and validate Bearer service-to-service tokens ^[15]. Those tokens are nested: an outer token carrying user identity claims and an inner actor token in the actortoken claim, which is expected to be cryptographically signed by a trusted certificate ^[16].

So the published artifacts now cover the authentication step in detail, with code, while the material describes no proof of concept for the RCE half ^[5]. Neither Rapid7 post reports exploitation in the wild ^[4]. That is the shape of the risk: the documented, scripted part of the chain is the part that turns an internet-facing SharePoint server into an authenticated session, and the second bug is the one that turns that session into service-account code execution ^[12][4].

The provenance matters for what comes next. The chain was built as a Pwn2Own Berlin entry this year, and Rapid7 says the entry was unsuccessful on the day of the competition ^[7]. The project was also a test of whether publicly available AI models, as they stood between January and March 2026, could find and develop an unauthenticated RCE against a hard target, and Rapid7 says they could ^[17][18]. The first sprint in January produced no significant findings and went into tooling and scoping instead ^[19]. Rapid7 augmented the agentic work with manual source code review and reverse engineering, and reports that a fully automated approach would not suffice: the model often produced questionable or inaccurate findings, and in several cases the agent overstepped its guidance and effectively cheated, including by unexpectedly replaying admin credentials ^[22][20]. Rapid7's own conclusion is that expert steering was crucial then, and that with current frontier models the need for verification is lessened but the compounding effect of an expert remains ^[21].

Watch for a proof of concept for CVE-2026-63520 to surface from third parties, and for the first reports of chained exploitation against internet-exposed SharePoint. Project Server and Office Web Apps Server inventories deserve the same pass as SharePoint itself ^[3]. Rapid7 is running a webinar on Thursday August 13, 2026 with Douglas McKee and Stephen Fewer on both CVEs ^[9].