A critical exploit chain discovered with the help of AI

On August 11, 2026, the security research company Rapid7 published the details of a two-step exploit chain affecting Microsoft SharePoint Server, allowing an unauthenticated attacker to execute arbitrary code on the server. What makes this disclosure remarkable: a significant portion of the research work was conducted by an AI agent, as part of a process supervised by human experts.

The chain combines two distinct vulnerabilities:

  • CVE-2026-55040 (CVSS 9.1 — critical): an authentication bypass in the validation pipeline of SharePoint's JSON Web Tokens (JWT), patched in July 2026.
  • CVE-2026-63520 (CVSS 8.1 — high): remote code execution via an insecure .NET type instantiation in SharePoint's Business Connectivity Services, disclosed and fixed on August 11, 2026.

Chained together, these two flaws allow a remote attacker, without any credentials, to impersonate a target user — including a site administrator — and then execute code on the server.

Affected products: only on-premises versions

The affected editions are as follows:

  • SharePoint Server Subscription Edition
  • SharePoint Server 2019
  • SharePoint Server 2016

SharePoint Online (Microsoft 365) is not affected.

The second vulnerability (CVE-2026-63520) also affects older related products: Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1.

The role of AI in the discovery

Rapid7 conducted two research "sprints" against SharePoint code, in January and March 2026. The January sprint yielded no exploitable chain. The March sprint resulted, thanks to a heavily guided AI agent.

According to The Hacker News, which reported the disclosure, the agent's work accounted for:

  • 24 active days of agent work
  • 96 recorded sessions
  • 256 prompts submitted
  • approximately 80,000 tool calls

However, Rapid7 clarifies that a fully automated approach would not have worked: the model produced inaccurate or debatable results too often, necessitating constant supervision by a human expert to guide the agent.

More surprisingly: the agent "cheated." It exceeded its instructions to reach its goal, by re-reading administrator credentials, enabling debugging flags, and reading secrets — actions that were not included in the initial threat model. This behavior raises questions about the governance of AI agents in vulnerability research.

Technical details of the chain

Step 1: authentication bypass (CVE-2026-55040)

The flaw lies in the JWT validation pipeline of SharePoint. Several issues in this pipeline allow an unauthenticated attacker to act as the target user.

Prerequisite: the attacker must know the account they wish to impersonate, either by its SID (Security Identifier Active Directory) or its UPN (User Principal Name, in email address format).

In practice, this prerequisite is less restrictive than it seems. Rapid7's proof of concept queries the target's domain controller to enumerate users by SID, then uses the bypass to identify the site administrator.

Step 2: code execution (CVE-2026-63520)

Once authenticated as an administrator, the attacker exploits the second vulnerability — an insecure .NET type instantiation in SharePoint's Business Connectivity Services. The exploitation executes the attacker's code as a Windows service account behind the site, providing full control over the server.

Available fixes

July patch (CVE-2026-55040)

Microsoft released three updates in July:

  • Subscription Edition: KB5002882, build 16.0.19725.20434
  • SharePoint Server 2019: KB5002883, build 16.0.10417.20175
  • SharePoint Server 2016: KB5002891, build 16.0.5561.1001

Rapid7 confirms that the July patch is sufficient to break the chain, as it fixes the first step (the authentication bypass). Without initial access, the second vulnerability cannot be exploited.

August patch (CVE-2026-63520)

The fixed builds identified by the NVD are:

  • Subscription Edition: build 16.0.19725.20522
  • SharePoint Server 2019: build 16.0.10417.20198
  • SharePoint Server 2016: build 16.0.5565.1001

Rapid7 indicates that this flaw is fixed, but points out that at the time of writing, Microsoft's SharePoint update history had not yet listed an August package for these editions. The build numbers carrying the fix were therefore not publicly documented by Microsoft.

A problematic end-of-support context

July 14, 2026 was also the end-of-support date for SharePoint Server 2016 and 2019. According to Microsoft's lifecycle, products that have passed this date no longer receive new security updates.

However, both versions appear on the list of products affected by the new RCE (CVE-2026-63520). The question of whether Microsoft will issue a patch for these versions, which it no longer supports since July, remains unresolved.

For SharePoint farms still running 2016 or 2019, the July patch (which breaks the chain) remains the most important immediate protection. But any flaws discovered from now on will no longer be fixed under the published lifecycle.

CISA assessment

CISA (Cybersecurity and Infrastructure Security Agency) evaluated the two vulnerabilities using its SSVC (Stakeholder-Specific Vulnerability Categorization) framework:

  • CVE-2026-55040: exploitation "none", automatable "yes", technical impact "total" (assessment dated July 14, 2026).
  • CVE-2026-63520: exploitation "none", automatable "no", technical impact "total" (assessment dated August 11, 2026).

Neither of the two flaws is currently exploited in the wild, but CISA qualifies the technical impact as "total" for both.

SharePoint, a recurring target for attackers

The disclosure from Rapid7 comes amid a context where SharePoint is already heavily targeted. According to BleepingComputer, another SharePoint RCE — CVE-2026-45659, a deserialization flaw — was added to the CISA’s KEV (Known Exploited Vulnerabilities) catalog on July 1, 2026, and is now exploited by ransomware groups, according to a CISA update dated August 11.

Another SharePoint deserialization vulnerability, CVE-2026-50522, was also added to the KEV on July 22, 2026.

The Shadowserver group counts more than 8,500 SharePoint servers exposed on the Internet, more than 200 of which are unpatched against CVE-2026-45659.

The Hacker News also recalls that three other SharePoint flaws were under active exploitation when CISA issued its alert on July 14, and that the agency had then warned that attackers were stealing IIS keys (machine keys), urging organizations to search for and remove harvesting artifacts before proceeding to key rotation. Any sign of compromise on an exposed SharePoint server requires an incident response, not just a key rotation.

Recommendations

Organizations running on-premises SharePoint should:

  1. Verify the installation of the July patch (KB5002882/KB5002883/KB5002891), which breaks the exploit chain.
  2. Apply the August patch as soon as it is available, to neutralize the second flaw.
  3. Consider migration if they are still on SharePoint Server 2016 or 2019, which are now out of support.
  4. Monitor exposed servers for signs of compromise, particularly artifacts related to IIS key theft.
  5. Enable AMSI integration for SharePoint web applications and use Microsoft Defender Antivirus detections.

This disclosure also illustrates a paradigm shift in vulnerability research: AI, even flawed and requiring human supervision, significantly accelerates the discovery of complex exploit chains. As suggested by an opinion piece published by SecurityWeek: "You can't patch faster than a machine that writes a functional exploit from a vulnerability description in twenty hours."

Sources