SharePoint Exploit Code Puts Thousands of Internet-Facing Servers At Risk

For IT teams running on-premises SharePoint, patching delays can quickly become a security liability. Once proof-of-concept (PoC) exploit code becomes public, attackers often move quickly to test and weaponize it, which leaves unpatched servers exposed to compromise. Microsoft is now facing that scenario after researchers disclosed a new SharePoint exploit chain that combines two vulnerabilities into a potential path for remote code execution.

According to threat intelligence firm Defused, cybercriminals leveraged an attack chain (CVE-2026-55040 and CVE-2026-63520) to probe its SharePoint honeypots. This activity follows the public release of PoC code for both vulnerabilities, which reduced the technical barrier for threat actors seeking to exploit vulnerable environments.

How does the attack chain work?

The first vulnerability (CVE-2026-55040) is an authentication bypass flaw in SharePoint’s JWT validation process. If exploited, attackers can impersonate legitimate SharePoint users or administrators without valid credentials. The second flaw, CVE-2026-63520, affects Business Connectivity Services and can be leveraged after the authentication bypass to achieve remote code execution on the SharePoint server.

Security researchers mentioned that these vulnerabilities become more dangerous when combined. They can provide an unauthenticated path to executing arbitrary code, which potentially gives attackers significant control over affected SharePoint environments.

The bigger concern for organizations

Until now, Defused has only observed probing and reconnaissance activity, and not confirmed successful code execution. However, the appearance of public exploit code suggests attackers are actively evaluating targets and looking for vulnerable systems. Some earlier reports also indicated that the authentication bypass flaw began attracting malicious activity shortly after its PoC was released.

This concern is increased by the large number of internet-facing SharePoint servers. Shadowserver has identified more than 8,700 exposed SharePoint instances, which creates a pool of potential targets if organizations have not applied Microsoft’s security updates.

What organizations should do?

Organizations should prioritize patching both vulnerabilities, review Microsoft’s SharePoint hardening guidance, and identify any internet-exposed SharePoint servers that may require additional protection. Security teams should also monitor logs for suspicious authentication activity, administrative enumeration attempts, and unusual interactions with Business Connectivity Services.

Fortunately, cybersecurity researchers have not yet confirmed widespread compromise in enterprise environments. However, keep in mind that the growing interest from attackers means organizations may have limited time to secure vulnerable SharePoint deployments.