The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.
Two weeks ago, a JWT validation bug in SharePoint let an unauthenticated attacker impersonate any site user or admin — bad, but capped, because on its own it doesn't get you code execution. That cap is gone. A second SharePoint vulnerability, CVE-2026-63520, was published with a working proof-of-concept on August 24, and chaining it after the JWT bypass turns "I can pretend to be an admin" into "I can run arbitrary code on your server." Threat intel firm Defused says the chain is already being probed in its honeypots.
How the chain actually works
CVE-2026-55040's flaw is in how SharePoint validates JSON Web Tokens — the credential-like tokens the platform uses internally to authorize requests. A malformed or forged token that shouldn't pass validation does, letting an attacker perform actions as a site user or administrator without ever logging in. Rapid7 researcher Stephen Fewer published a proof-of-concept for that half on August 11. On its own, it's a serious authorization failure. It is not, by itself, remote code execution.
CVE-2026-63520 is what closes that gap. It lives in Business Connectivity Services, the SharePoint feature that connects site content to external data sources. The vulnerable function, DotNetAssemblyConnectionManager.GetEntityObject, resolves .NET type names from Business Data Catalog models and instantiates them via Activator.CreateInstance without adequately restricting which types are safe to instantiate. VulnCheck researcher Jonathan Peterson demonstrated that an attacker who already has admin-level access — exactly what CVE-2026-55040 hands over for free — can point that function at System.Web.UI.LosFormatter, trigger unsafe deserialization, and get code execution on the server. Peterson published that half of the chain on August 24.
The two-stage chain
Stage 1
Stage
CVE-2026-55040
CVE
Admin-level access with zero credentials, via forged JWT
Stage 2
Stage
CVE-2026-63520
CVE
Full remote code execution via unsafe BCS type instantiation
Stage
CVE
Gets you
Stage 1
CVE-2026-55040
Admin-level access with zero credentials, via forged JWT
Stage 2
CVE-2026-63520
Full remote code execution via unsafe BCS type instantiation
On-premises SharePoint Server deployments — not SharePoint Online — are the exposure here. · Unsplash
No — this chain targets on-premises SharePoint Server deployments, specifically ones with Business Connectivity Services configured. SharePoint Online (Microsoft 365) is a different, Microsoft-managed environment and isn't implicated in this advisory.
Is the fix already available?
Yes. The August 2026 cumulative update (KB5002893) adds an explicit allow-list — BCSAllowedTypeNames — so only pre-approved .NET types can be instantiated through BCS, closing the RCE half of the chain.
Has anyone actually been breached yet?
Not confirmed as of August 25. Defused's honeypots show the JWT bypass being exercised and admin functions being enumerated, but no observed code execution yet. That gap is likely to close fast given the two-week PoC timeline.
Does patching just the newer CVE fix the whole chain?
You need both. CVE-2026-63520's fix blocks the RCE step, but if CVE-2026-55040 is still unpatched, an attacker can still forge admin access and go looking for other post-auth paths. Patch to the full August 2026 CU, not a single hotfix.
If you're running on-prem SharePoint Server with BCS enabled and haven't applied the August cumulative update, do it before the weekend, not after. The honeypot activity says reconnaissance is already underway; the only open question is how long the gap to a confirmed real-world compromise turns out to be, and on this timeline, I wouldn't bet on it being long.
