Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.
Microsoft shipped a patch on August 12 for a bug that lets an attacker take over a SharePoint server without ever logging in — and how it was found is arguably the bigger story. Rapid7 researcher Stephen Fewer spent 120 hours across 24 days pointing an AI agent at SharePoint's Business Connectivity Services, running 96 separate sessions and roughly 80,000 individual tool calls, until it produced a working exploit. That's CVE-2026-63520, and chained with a JWT authentication bypass Rapid7 disclosed last month, it lets an attacker walk in as any user — including an administrator — with no valid account at all.
What CVE-2026-63520 actually does
The bug lives in Business Connectivity Services, the SharePoint component that pipes in external data from things like SQL Server and SAP. Rapid7 classifies it as an unsafe .NET type instantiation issue (CWE-20, improper input validation) — an attacker crafts a custom .NET gadget chain that gets deserialized and executed instead of just parsed, running arbitrary OS commands with the privileges of the SharePoint site's service account. On its own, that already requires a valid login. It's the second bug, CVE-2026-55040, that removes even that requirement by forging a JWT token good enough to impersonate anyone on the server.
8.1
CVSS score
High severity
120 hrs
Agent runtime
across 24 days
~80,000
Tool calls
96 agent sessions
5
Patches shipped
KB updates, Aug 12
Why an AI found this, and not just a person
Fewer wasn't turning an AI loose on SharePoint unsupervised — Rapid7 has been explicit that subject-matter oversight was doing the real steering, catching the model's dead ends and outright wrong guesses along the way. What changed is the pace: reverse-engineering a proprietary enterprise codebase for a gadget chain like this used to be a months-long slog for a human alone. Here it took 24 days of wall-clock time, most of it agent runtime rather than researcher time. That's the same shift Unit 42 documented when its own AI system surfaced 14,090 real bugs in open-source code in two months — vulnerability research is getting a speed multiplier, and it's not slowing down to wait for defenders to catch up.
AI-assisted workflows are compressing vulnerability research that used to take months into weeks. · Unsplash
Is your SharePoint exposed?
Check your version — Subscription Edition, Server 2019, and Enterprise Server 2016 are all affected, plus Project Server and Office Web Apps Server.
Apply KB 5002893, 5002894, 5002896, 5002905, or 5002906 depending on your build — Microsoft's August 12 rollup covers all of them.
Patch CVE-2026-55040 too. Alone, CVE-2026-63520 still needs an authenticated account — the JWT bypass is what turns it into a zero-login attack.
If you can't patch immediately, restrict external access to Business Connectivity Services endpoints and watch for anomalous w3wp.exe process behavior.
This is also the second month running where an authentication bypass chained into full RCE has been the pattern, not the exception — see the same shape in SonicWall's SMA appliances and n-able's N-central. If your organization runs on-prem enterprise software with an internet-facing management surface, auth-bypass-plus-RCE is the exploit shape to specifically hunt for in your own stack this quarter, not just this one product.
SharePoint RCE FAQ
Do I need to be logged in for CVE-2026-63520 to be exploited?
Not if it's chained with CVE-2026-55040, the JWT authentication bypass Rapid7 disclosed in July. Combined, the two bugs let an attacker impersonate any user, including an admin, and reach RCE with zero valid login. On its own, CVE-2026-63520 still needs an authenticated account.
What privileges does an attacker get?
Code execution with the privileges of the SharePoint site's service account — not automatically full domain admin, but enough to read, modify, or exfiltrate whatever that account can reach, and a common pivot point toward broader compromise.
Is this being actively exploited in the wild?
Not as of this writing. Rapid7 went through coordinated disclosure with Microsoft, and full technical exploit details are being held back for 30 days — the patch window that actually matters.
Does this affect SharePoint Online (Microsoft 365)?
The affected products are on-premises SharePoint Server releases — Subscription Edition, 2019, and Enterprise Server 2016 — plus Project Server and Office Web Apps Server. Cloud-hosted SharePoint Online wasn't among the versions Rapid7 or Microsoft listed.
Where can I read the full technical writeup?
Rapid7 says the complete exploit chain details will publish within 30 days of the August 11 disclosure, once organizations have had time to patch.
Watch for that 30-day technical drop — once the full gadget chain is public, the patch-now window closes fast and this becomes exactly the kind of bug opportunistic scanners pick up within days. Until then, the patches are out and the fix is boring: apply them.
