Token validation is where a server decides whether a signature and a bag of claims deserve to be believed. CVE-2026-55040 is described as a flaw in exactly that check for SharePoint's JWTs, and the result is that an unauthenticated caller can act as a site user or administrator [2]. Nothing downstream is confused. The authorization code answers correctly for the principal it was handed, and it permits the API operations that principal is entitled to [6]. That is the mechanical reason the source says this needs no user interaction and looks unremarkable from regular SharePoint screens [7].
An identity is not an execution primitive, which is why the observed traffic keeps going. After the bypass the attacker enumerates management functions [3], then hunts for the CVE-2026-63520 sink in Business Connectivity Services and the Business Data Catalog [4]. The chain has a seam, and the source names three conditions across it: a server unpatched for both CVEs, network reachability from attacker to target, and BCS or BDC still reachable once authentication is out of the way [10].
Honeypots recorded the bypass, the enumeration and the probing, and did not record code execution [5]. That reaches the second of the three confirmation stages the write-up defines, with host-level execution unverified in public data [19]. Read the absence narrowly. Honeypots are instrumented to be interesting rather than to be representative of your patch level, so "no execution observed" describes what those sensors caught, not the reliability of the sink. What would upgrade the picture is host telemetry: child processes under w3wp, PowerShell or cmd, web shells, file writes, new scheduled tasks or service changes [9].
Patch order is the decision worth getting right. Shipping only Microsoft's 63520 update closes the road to code execution and leaves the unauthenticated administrator-equivalent API access sitting where it was [18]. Document access follows from that position alone; the credential and internal-connection outcomes are the ones the source marks as conditional on a successful chain and unconfirmed by the honeypot data [16].
In my context the network control goes first, because restricting internet exposure and BCS surfaces, or blocking post-bypass management calls at a WAF, lands in minutes without a maintenance window while the updates move through change control behind it [11]. Detection is the expensive part. The available signals are abnormal JWTs, management API enumeration from unauthenticated sources and continuous probes to the Business Data Catalog [8], and turning those into a verdict means matching request subjects against Entra or AD logins to find privileged operations with no corresponding sign-in [12]. That is a join across two systems most teams have not built. If execution does get confirmed on a host, the bill is isolation plus rotation of SharePoint, IIS and service account credentials [17].
