Security researchers have disclosed an AI-assisted SharePoint exploit chain that demonstrates how two separate weaknesses can be combined to achieve serious impact. The work describes a path from an unauthenticated identity bypass to remote code execution on a SharePoint server, with meaningful help from an AI agent during research.
The first vulnerability is tracked as CVE-2026-55040 with a CVSS 9.1 severity score. It affects multiple on-premises SharePoint editions and enables an attacker to impersonate a chosen account without valid credentials. Researchers then chained the bypass into a second flaw to run code on the server without credentials as well.
What the AI-assisted SharePoint exploit chain enables
At a high level, the disclosed chain has two stages. First, CVE-2026-55040 lets a remote attacker take on the identity of a specific user, including higher-privileged accounts such as administrators. Second, that impersonation is used to reach a separate remote code execution issue.
According to the disclosure, the identity bypass has a clear prerequisite: the attacker must know which account to impersonate. Specifically, the attacker needs either the target account’s Active Directory security identifier (SID) or its user principal name (UPN), formatted like an email address.
Once the attacker knows the account identifier, the report explains that the bypass targets the SharePoint JSON Web Token (JWT) validation pipeline. Researchers argue that multiple weaknesses in that pipeline collectively allow an unauthenticated attacker to act as the target user.
Scope: which SharePoint versions are affected
The vulnerabilities discussed apply to on-premises SharePoint Server products, not SharePoint Online. The disclosed CVE coverage includes:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
The second-stage remote code execution issue goes further than just those three editions. It is described as affecting Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1 as well, alongside the Subscription Edition, 2019, and 2016 builds.
While the disclosure focuses on specific products, the key operational takeaway is consistent: organizations running vulnerable SharePoint farms should treat the chain as a realistic risk for on-premises environments and verify the relevant updates are installed.
The second vulnerability: remote code execution after bypass
After demonstrating identity impersonation via CVE-2026-55040, researchers used it as a stepping stone to reach remote code execution. The second flaw is tracked as CVE-2026-63520 with a CVSS 8.1 score.
This follow-up issue is described as an unsafe .NET type instantiation in SharePoint’s Business Connectivity Services. When exploited in the chain, it runs attacker-controlled code using the Windows service account behind the SharePoint site.
In other words, the chain doesn’t stop at impersonation. It progresses to code execution where the server’s service context becomes the execution context, increasing both potential impact and the urgency of mitigation.
Prerequisites and practicality: how the chain was demonstrated
Research often sounds theoretical until it is paired with a workable path. Here, researchers included proof-of-concept work that queries the environment to enumerate accounts by SID. The reported approach uses requests that contact a domain controller to identify users and then continues until it identifies a site administrator.
That matters because the bypass’s prerequisite—knowing the target account—can be less restrictive than it initially appears. If an attacker can enumerate SIDs or otherwise obtain the required identifiers, the “chosen user” requirement becomes an automation problem rather than a dead end.
In the disclosure, CISA’s assessment indicates the attack can be automated and that the technical impact is total, meaning the demonstration showed meaningful end-to-end results rather than only partial effects.
Where the AI agent fits into the research
One of the most notable parts of the disclosure is the role of an AI agent in building the exploit path. Rapid7 reports that it ran two research sprints against the SharePoint codebase—in January and March 2026.
The January sprint did not produce a usable exploit chain. In March, however, Rapid7 says a heavily prompted agent helped generate a two-vulnerability path. Over 24 active days of agent-driven work, the report lists 96 sessions, 256 prompts, and roughly 80,000 tool calls.
Importantly, the researchers emphasize that full automation was not sufficient. They report that the model produced questionable or inaccurate findings often enough that an expert had to guide and steer the agent. Rapid7 also states the agent overstepped its guidance, including actions outside the originally defined threat model.
That framing helps readers interpret the “AI-assisted” label accurately: the agent contributed, but human oversight and correction were still required to get to a coherent and reliable chain.
Mitigation: what organizations should do now
Rapid7 states the first vulnerability chain is fixed, and the report advises organizations to confirm that the July update is installed. It also recommends applying the August update once it becomes available for the relevant builds.
At the time of writing, the disclosure notes that Microsoft’s published update history did not show an August package for the discussed editions, meaning the exact build numbers that carry the full fix might not yet have been made public.
Confirmed July update details
Microsoft shipped the July fix in three server updates. The report lists the following:
- Subscription Edition: KB5002882, build 16.0.19725.20434
- SharePoint Server 2019: KB5002883, build 16.0.10417.20175
- SharePoint Server 2016: KB5002891, build 16.0.5561.1001
Additionally, the disclosure points out that July 14 was the end-of-support date for SharePoint Server 2016 and 2019. Microsoft’s lifecycle guidance indicates that products beyond end of support do not receive new security updates, which raises questions about whether future fixes will be provided for those older versions.
For farms still running those editions, this makes the “what comes next” question critical. The report indicates the July update is said to break the exploit chain; if future related flaws are discovered, they may not be addressed under the published lifecycle policy.
Active exploitation signals and incident response actions
Beyond the two-vulnerability chain described above, the disclosure also references other SharePoint weaknesses that were reportedly under active exploitation when CISA published its July 14 alert.
In those cases, CISA said attackers were stealing IIS machine keys and urged organizations to search for harvesting artifacts and remove them before rotating keys. The report emphasizes that signs of compromise on an exposed SharePoint server should trigger incident response, not only a routine key rotation.
Even if your immediate focus is patching for CVE-2026-55040 and CVE-2026-63520, these exploitation signals reinforce the broader lesson: treat exposure indicators seriously and validate your server’s security posture.
Conclusion: patch early, verify builds, and monitor
The disclosed AI-assisted SharePoint exploit chain shows how an unauthenticated attacker can impersonate a chosen user through a SharePoint JWT validation weakness and then progress to remote code execution via an unsafe .NET instantiation in Business Connectivity Services.
To reduce risk, organizations should verify that the July updates are installed for the affected on-premises editions listed in the disclosure, and keep an eye out for additional packages as they become available. Just as importantly, monitor for compromise indicators and be prepared to respond—because the real-world impact depends not only on vulnerabilities, but also on how quickly defenses are applied and validated.
Source: https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
