Hackers Are Now Chaining Two SharePoint Bugs to Take Over Servers

Key points

• Attackers are chaining two Microsoft SharePoint flaws, CVE-2026-55040 and CVE-2026-63520, to run their own code on unpatched servers.
• Security firm Defused saw the first flaw exploited within a day of a public proof-of-concept being posted on August 11.
• By August 25, Defused reported both flaws being used together against its decoy servers.
• Shadowserver counts more than 8,700 SharePoint servers reachable from the open internet.
• CISA ordered US federal agencies on August 18 to patch the first flaw, and has since confirmed a separate SharePoint bug is being used in ransomware attacks.

Microsoft SharePoint, the widely used platform companies run to share internal documents, is under active attack again. This time criminals are stringing together two separate bugs to break in and run whatever code they like on servers that have not been patched.

The warning comes from threat intelligence firm Defused, which watched the attacks land in its honeypots, decoy servers built to attract hackers so defenders can study them. First reported by BleepingComputer, the activity started almost immediately after researchers published working exploit code online.

How does the attack actually work?

The hackers use two flaws back to back. The first gets them in the door. The second lets them run commands on the server.

The first bug, CVE-2026-55040, sits in the way SharePoint checks JSON Web Tokens, the small signed passes that prove a user is logged in. A hacker with no account can trick the server into treating them as a site user or even an administrator. In plain terms, it is an authentication bypass: the lock exists, but the key check is broken.

The second bug, CVE-2026-63520, lives in a SharePoint feature called Business Connectivity Services, which pulls in data from other business systems. Once an attacker has faked their way past the first check, this second flaw lets them run their own code on the server. That is what security people mean by remote code execution.

Working exploit code, called a proof-of-concept, was published for the first flaw by Rapid7 researcher Stephen Fewer on August 11. VulnCheck's Jonathan Peterson released code for the second on August 24. Defused says Rapid7's code was being fired at real servers within 24 hours of going public.

Who is at risk?

Any organisation running its own SharePoint server that is reachable from the internet. Shadowserver, a non-profit that scans the public internet, currently counts more than 8,700 exposed SharePoint servers, though it is not clear how many are already patched or are themselves honeypots.

The US Cybersecurity and Infrastructure Security Agency, known as CISA, told federal agencies on August 18 to secure their SharePoint servers against attacks using the first flaw. Microsoft has flagged the second flaw as an attractive target but has not yet marked it as exploited in the wild.

What should IT teams do now?

Patch, and stop putting SharePoint on the open internet if you can avoid it. That is CISA's blunt guidance, and it applies here.

Since November 2021, CISA has flagged 15 SharePoint flaws as actively exploited. Eight of those have also been picked up by ransomware gangs, the criminals who lock a company's files and demand payment to unlock them. On Tuesday CISA confirmed CVE-2026-45659, a separate SharePoint bug, is now being used in ransomware attacks too.

Would multi-factor authentication have saved anyone here? Honestly, no. The first flaw forges the token that proves a user is signed in, which sits after MFA has done its job. This one is on patching and network exposure, not on the login screen.