What happened
On August 11, 2026, public proof-of-concept code for CVE-2026-55040 was released. CISA added CVE-2026-55040 to KEV on August 18, 2026 after evidence of active exploitation. On August 24, 2026, VulnCheck published technical analysis of a complete unauthenticated SharePoint code-execution chain using both flaws. The chain combines CVE-2026-55040, a JWT authentication bypass, with CVE-2026-63520, unsafe .NET type instantiation in SharePoint Business Connectivity Services.
An attacker can use the authentication weakness to forge a privileged SharePoint context and obtain the values needed to make consequential BDC changes. The documented path centres on a BDC model and a POST request to /_vti_bin/client.svc/ProcessQuery. VulnCheck identified a new ValidateSafeBcsType function in Microsoft.SharePoint/Microsoft/SharePoint/BusinessData/Infrastructure/DotNetTypeReflector.cs while analysing the fix. The fixed build thresholds are 16.0.19725.20522 for SharePoint Server Subscription Edition, 16.0.10417.20198 for SharePoint Server 2019 and 16.0.5565.1001 for SharePoint Enterprise Server 2016.
VulnCheck reported at least 8,500 SharePoint servers online after removing honeypots and deduplicating its data. That is an exposure estimate, not a count of vulnerable or compromised systems. The cited sources did not establish successful in-the-wild code execution for CVE-2026-63520 by the edition cutoff. Attribution posture: CISA confirms exploitation of CVE-2026-55040 but the cited sources name no actor and do not attribute exploitation of the full chain. The cited source did not publish the relevant telemetry detail described as Successful in-the-wild code execution through CVE-2026-63520 had not been established.
Why this matters now
CVE-2026-55040 was already an urgent authentication problem because exploitation had been confirmed. The newly documented chain changes the consequence: a forged privileged SharePoint context can reach Business Connectivity Services functionality affected by CVE-2026-63520 and progress to server-side code execution when both fixes are absent.
The technical disclosure reduces uncertainty for attackers and defenders. It identifies the patched validation function, the vulnerable service area and the request path used by comparable BDC attacks. Organisations cannot rely on the earlier authentication-bypass patch alone if their August SharePoint update for the second flaw is missing.
Internet-exposure counts indicate a substantial reachable population, but they do not identify how many systems are vulnerable or compromised. Leadership should use its own build inventory and exposure testing, then separate patch evidence from a retrospective investigation of privileged requests, Business Data Catalog changes and unexpected server execution.
The decision for security leaders
Require the SharePoint owner to report compliance at farm and server level, not from a single management view. Both CVEs and every server role must be covered because partial farm patching can leave an inconsistent or exposed control surface.
Separate exposure reduction from compromise assessment. Restricting access and reaching a fixed build address future attempts; they do not explain privileged JWT activity, BDC modifications or commands that may have executed while the chain was available.
Where telemetry is insufficient, document the assurance gap and consider clean rebuild, application-secret rotation and validation of connected line-of-business systems. Business Connectivity Services may bridge SharePoint to data sources that require their own containment decision.
Evidence of closure
- A farm inventory confirms every server meets the fixed build for both CVEs.
- External validation shows no unapproved on-premises SharePoint service remains internet-accessible.
- A hunt report documents the disposition of ProcessQuery and Business Data Catalog anomalies.
- Incident response approves the compromise status of every previously exposed farm.Connected-system owners document any remaining assurance limitations or required secret rotation.
The Security.io assessment
The new fact is a complete public chain, not authoritative confirmation that CVE-2026-63520 is already producing successful code execution in attacks. Security.io therefore treats the first flaw as confirmed actively exploited and the second as a practical public escalation path whose exploitation status remains unresolved.
The exposure figure demonstrates reachability, not vulnerability. Versions, patch consistency, trusted-identity configuration and network controls determine local risk. Organisations should not use the global count to claim compromise, but it supports immediate verification of any on-premises SharePoint environment that remains reachable from the internet.
VulnCheck says its complete exploit, scanner, packet captures, detection rules and asset queries are available to customers rather than fully published in the article. Defenders without those artefacts still have actionable pivots in the fixed builds, BDC service area and ProcessQuery endpoint.
Questions for the morning meeting
- Are all SharePoint farms above the fixed build for both CVEs?
- Which on-premises SharePoint servers remain internet-accessible?
- Can retained IIS and SharePoint telemetry distinguish scanning from successful execution?
- Who owns secret rotation if the SharePoint application tier is considered compromised?