GoKawiilAttackers chain two Microsoft SharePoint flaws using public PoC exploits
Threat intelligence firm Defused reports that hackers are actively probing SharePoint servers by combining two vulnerabilities: an authentication bypass in JWT token validation (CVE-2026-55040) and a Business Connectivity Services flaw (CVE-2026-63520) that enables remote code execution. Proof-of-concept code for both bugs was published publicly in August by researchers at Rapid7 and VulnCheck, and Defused says it has already observed the bypass being exploited alongside admin enumeration on honeypots, though no successful code execution has been confirmed yet.
GoKawiil's interpretation of the reporting above, not reported fact.
With over 8,700 SharePoint servers still exposed online according to Shadowserver, the availability of working exploit code lowers the barrier for attackers to gain full server control before organizations patch. The pattern—rapid weaponization of PoCs within a day or two of release—shows how little time defenders have to respond once vulnerability chains become public.
- Two chained SharePoint flaws let unauthenticated attackers potentially achieve remote code execution.
- Public PoC exploits released in August are already being used in real attacks against honeypots.
- Thousands of SharePoint servers remain internet-exposed and at risk if unpatched.
Yubico YubiKey 5 NFC Security Key — When authentication bypass bugs are being weaponized within days of a PoC drop, hardware-backed MFA is one of the few controls attackers can't phish around. The YubiKey 5 NFC plugs into USB-A or taps an NFC phone and works with Microsoft 365, FIDO2/WebAuthn, and countless other services, making it a solid layer of defense for admins guarding SharePoint and other servers.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-26
Published there as: “Hackers target Microsoft SharePoint RCE chain with PoC exploit”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.