Security teams running Microsoft SharePoint on premises have a high-priority patching and investigation task. Two vulnerabilities can be combined to move from an unauthenticated request to code execution on the SharePoint server, turning what might look like a narrow token-validation problem into a practical route for full compromise.

The chain joins CVE-2026-55040, a critical authentication bypass scored 9.1 under CVSS v3.1, with CVE-2026-63520, a high-severity remote code execution issue scored 8.1. Microsoft has released updates for supported on-premises editions. SharePoint Online in Microsoft 365 is not affected.

How the authentication barrier is removed

CVE-2026-55040 affects SharePoint’s handling of JSON Web Tokens. According to the technical analysis, an attacker who knows a target user’s security identifier or user principal name can construct a token that SharePoint accepts and then impersonate that user. The weakness stems from insufficient validation in the JWT processing path, including acceptance of an unsigned outer token and inadequate verification of an embedded actor token in some circumstances.

That does not require the attacker to obtain the user’s password. If the selected identity has administrative privileges, the forged token provides access to endpoints that should be protected by authentication. This is the crucial first half of the chain because it supplies the authorization needed to reach the vulnerable SharePoint functionality used in the second stage.

The risk is no longer theoretical. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, signaling observed exploitation. Organizations should therefore treat unpatched, internet-facing servers as potential incident-response cases rather than assuming that installing an update alone closes the matter.

Business Connectivity Services becomes the execution path

CVE-2026-63520 sits in Business Connectivity Services, the SharePoint feature used to connect external data and .NET applications. Before the fix, a Business Data Connectivity model could specify unsafe .NET types. Researchers demonstrated that the LosFormatter class could serve as a deserialization gadget and ultimately run attacker-chosen code in the server environment.

In the reported sequence, the attacker forges a JWT, assumes a privileged SharePoint identity, retrieves a form-digest value and uploads a malicious BDC model. The attacker then creates an external list and triggers the vulnerable processing path. Each issue amplifies the other: the token flaw grants the required access, while the BCS flaw converts that access into code execution.

Public exposure increases the urgency. Data cited by researchers identified roughly 21,000 on-premises instances disclosing version information. That figure is not a count of confirmed vulnerable systems, but it illustrates the potential attack surface and the ease with which adversaries can identify promising targets.

What SharePoint administrators should do now

Microsoft has issued August security updates for SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. Teams should apply the appropriate update as soon as possible, beginning with externally reachable deployments and servers holding sensitive data.

• Inventory every on-premises SharePoint server and confirm its exact build and patch level.
• Review logs for abnormal bearer-token authentication and access by unexpected privileged identities.
• Investigate unfamiliar BDC model uploads, external-list creation and requests to Business Data Catalog endpoints.
• Look for new processes, files, services or outbound connections originating from SharePoint hosts.
• Restrict external access where immediate patching is impossible and preserve evidence before remediation.

Because the authentication bypass has been exploited, defenders should widen their review beyond the moment the patch was installed. A threat actor who gained code execution earlier may have established another persistence mechanism. Credential rotation, endpoint triage and examination of adjacent systems may be appropriate when suspicious activity appears.

A chain that changes the risk calculation

Vulnerability severity is often assessed one CVE at a time, but this case demonstrates why reachable combinations matter. A flaw that creates a privileged identity and a separate flaw that executes code behind an authenticated boundary together produce a much more serious outcome. For exposed SharePoint deployments, fast patching paired with a focused compromise assessment is the safest response.