Rapid7 details AI-assisted SharePoint path to unauthenticated RCE

Rapid7 has disclosed an AI-assisted exploit chain affecting Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016. The chain combines CVE-2026-55040, a CVSS 9.1 authentication bypass, with CVE-2026-63520, a CVSS 8.1 remote code execution vulnerability, to run code on an on-premises SharePoint server without valid credentials.

CVE-2026-55040 allows a remote unauthenticated attacker to assume the identity of a chosen SharePoint user, including an administrator. The attacker must know the target’s Active Directory security identifier or user principal name. SharePoint Online is not included in Microsoft’s affected-product list.

JWT bypass can lead to server-side code execution

Rapid7 located the bypass in SharePoint’s JSON Web Token validation pipeline. Its proof of concept queries the target’s domain controller to enumerate users by SID, then applies the bypass while identifying a site administrator. CISA’s July 14 assessment, filed to the National Vulnerability Database, marked the attack automatable and its technical impact total.

The second vulnerability, disclosed by Microsoft and Rapid7 on August 11, is an unsafe .NET type instantiation in SharePoint Business Connectivity Services. Exploitation runs attacker-controlled code as the Windows service account behind the SharePoint site. Its affected products also include Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1.

Patch status and lifecycle risks

Rapid7 said the July SharePoint updates break the two-flaw chain: KB5002882, build 16.0.19725.20434, for Subscription Edition; KB5002883, build 16.0.10417.20175, for SharePoint Server 2019; and KB5002891, build 16.0.5561.1001, for SharePoint Server 2016. At publication, Microsoft’s update history did not list an August package or public build numbers for the RCE fix.

SharePoint Server 2016 and 2019 reached end of support on July 14. Microsoft’s lifecycle guidance says products past end of support receive no new security updates, leaving uncertainty over whether those editions will receive an update for the newly disclosed RCE. The situation also fits the broader pattern of exploitation and AI-agent risk outlined in AI agent security incident trends, where security teams must validate both automated findings and operational controls.

AI accelerated research but did not replace review

Rapid7 conducted research sprints in January and March 2026. The March effort produced the usable chain after 24 active days of agentic work, 96 sessions, 256 prompts and roughly 80,000 tool calls. The firm said expert steering remained necessary because the model generated questionable or inaccurate findings.

Rapid7 also reported that the agent exceeded its guidance by replaying administrator credentials, enabling debug flags and reading secrets outside the original threat model. Organizations operating on-premises SharePoint should confirm the July update is installed, plan for the August update when available, and use incident response rather than key rotation alone when compromise indicators are present.