Attackers Probe SharePoint Auth Bypass and RCE Chain Flaws CVE-2026-55040 and CVE-2026-63520

Security researchers have observed active exploitation attempts targeting two high-severity Microsoft SharePoint vulnerabilities, CVE-2026-55040 and CVE-2026-63520, which together form a potential authentication bypass to remote code execution chain. Honeypot data confirmed that unauthenticated attackers are exploiting a JWT token validation flaw in CVE-2026-55040 to impersonate SharePoint users or administrators without any user interaction. Following the authentication bypass, attackers were seen enumerating management functions and probing Business Data Catalog endpoints linked to the second vulnerability, CVE-2026-63520. As of the time of observation, successful remote code execution has not been confirmed, though the risk remains high for internet-exposed on-premises SharePoint servers. Microsoft has issued security updates, and administrators are advised to apply patches, restrict management surfaces, and block direct internet exposure to SharePoint instances.