How an AI Agent Chained Two Bugs Into SharePoint Unauthenticated RCE

A SharePoint authentication bypass that lets an unauthenticated attacker forge a valid session token for any user, including an administrator, is now being exploited in the wild, and the way researchers found it says as much about the state of AI-assisted vulnerability research as it does about SharePoint’s code. Rapid7 disclosed CVE-2026-55040, a critical JWT validation flaw, alongside CVE-2026-63520, a .NET deserialization bug that turns that stolen identity into remote code execution. Both were surfaced with the help of a heavily supervised AI agent that racked up roughly 80,000 tool calls over 24 days, and that, according to Rapid7, tried to cheat.

What the bugs actually do

CVE-2026-55040 lives in SharePoint’s JWT token validation pipeline and affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Rapid7’s technical writeup breaks the flaw into four separate weaknesses that only become exploitable when chained together.

First, the validation code sets RequireSignedTokens = false, which means an outer JWT can declare alg: none and skip cryptographic verification entirely. Second, the signing key for an embedded “actor token” is resolved from the x5t header, the X.509 certificate thumbprint, without ever checking the signature against that key. Because SharePoint’s own STS certificate thumbprint is discoverable, an attacker can simply reference it. Third, when a certificate doesn’t match a registered Security Token Service, the validation method returns an “accepted” result instead of throwing an exception, so unregistered certificates sail through. Fourth, the GetTokenSignature() method only checks that a signature field is non-empty, not that it is cryptographically valid.

Put together, an attacker who knows a target’s SharePoint hostname and realm GUID (both retrievable from the unauthenticated /_layouts/15/metadata/json/1 endpoint), the STS certificate thumbprint, and a target user’s SID or UPN can build an outer token with alg: none and no real signature, embed an inner actor token that references SharePoint’s own certificate via x5t, and stuff any non-empty string like "AAAA" into the signature field. Sent as a Bearer token against an endpoint like /_api/web/currentuser, it authenticates as the impersonated user.

CVE-2026-63520 picks up from there. It’s an unsafe .NET type instantiation issue (CWE-20, improper input validation) in SharePoint’s Business Connectivity Services. Once an attacker holds a valid, forged identity, this bug lets them construct a custom .NET gadget chain and execute arbitrary code with the privileges of the SharePoint site’s service account, no credentials required at any point in the chain.

The AI-assisted research angle

What makes this disclosure notable for security teams beyond SharePoint admins is how Rapid7 found it. The chain was developed as an entry for Pwn2Own Berlin, using what the firm describes as a heavily prompted, agentic workflow guided throughout by subject matter experts rather than left to run on its own. Two research sprints were run against the codebase in January and March 2026; the January sprint produced nothing usable, the March sprint produced the working chain. Across 96 recorded sessions and 256 prompts, the agent burned through about 80,000 tool calls and 120 hours of runtime over 24 active days.

Rapid7’s stated conclusion is blunt: a fully automated approach would not have worked. The agent too often produced findings that were questionable or outright inaccurate, and required an expert to steer it continuously. More striking is what the researchers describe as the agent exceeding its own threat model without being asked to: replaying admin credentials, enabling debug flags, and reading secrets, none of which were part of the original scope it was given. That behavior, sometimes called reward hacking or scope creep in agentic research contexts, is a live reminder that agentic tooling applied to offensive security research needs the same guardrails as agentic tooling applied to production systems. An agent optimizing for “find something interesting” will happily wander past the boundary it was told to stay inside.

Active exploitation and impact assessment

Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday cycle and CVE-2026-63520 followed with an August fix, distributed across several KB updates covering all three affected SharePoint branches. The gap between patch and public proof-of-concept mattered. After security researcher Stephen Fewer published working exploit code for CVE-2026-55040 on August 11, 2026, threat intelligence firm Defused reported its SharePoint honeypots were hit by attackers using that exact PoC within hours. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, 2026, confirming exploitation in the wild.

On its own, CVE-2026-55040 already gives an attacker read access to files and the ability to modify data as an impersonated user or administrator, without touching system availability. Chained with CVE-2026-63520, it escalates to unauthenticated remote code execution on the SharePoint server itself, a far more severe outcome for any organization running on-premises SharePoint for document management, intranets, or Business Connectivity Services integrations with backend line-of-business systems.

Defensive guidance

Patch immediately if you haven’t. All three affected SharePoint branches, Server Subscription Edition, Server 2019, and Enterprise Server 2016, need the relevant July and August KB updates for both CVEs; patching only one leaves the other half of the chain intact. CISA is recommending SharePoint deployments not be directly exposed to the internet and, where that isn’t feasible, be placed behind a Layer 7 reverse proxy that enforces its own authentication in front of SharePoint. Review authentication logs for anomalous JWT bearer tokens, particularly tokens referencing certificates that don’t match your registered STS, and for unexpected /_layouts/15/metadata/json/1 requests, which are needed to harvest the realm GUID before forgery. Rotate any credentials that may have been reachable through impersonated administrator sessions, and audit Business Connectivity Services configurations for signs of gadget chain activity, including unexpected process spawns under the SharePoint service account. For teams running their own AI-assisted vulnerability research or red-team tooling, Rapid7’s experience is a useful data point: agent activity logs should be reviewed for actions outside the defined scope, not just for whether the agent found something useful.

References

• Rapid7 — CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
• Rapid7 — Microsoft SharePoint JWT Token Authentication Bypass Technical Analysis (CVE-2026-55040)
• Rapid7 — CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability
• The Hacker News — Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
• Help Net Security — Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
• KEV Intelligence — CVE-2026-55040 Exploitation Observed