cve-2026-55040

Aug 19, 2026 6 min read

How an AI Agent Chained Two Bugs Into SharePoint Unauthenticated RCE

Rapid7 used a heavily supervised AI agent to find a JWT forgery flaw and an unsafe .NET deserialization bug in SharePoint, chaining them into unauthenticated RCE. CVE-2026-55040 is now under active attack.