Rapid7 Chains Two SharePoint CVEs Into Unauthenticated RCE, With an AI Agent's Help
Rapid7 Labs disclosed a two-CVE SharePoint chain reaching unauthenticated remote code execution as any user, including administrator. A JWT authentication bypass feeds an RCE flaw, both fixed in the August 11 Patch Tuesday. Notably, an AI agent helped find the chain.
Rapid7 Labs spent the first quarter of 2026 pointing publicly available AI models at one of the hardest targets in enterprise software — Microsoft SharePoint — and walked away with a working, unauthenticated path to remote code execution. On August 11, alongside Microsoft's Patch Tuesday, the company disclosed the second half of that work: CVE-2026-63520, a SharePoint remote code execution flaw that chains to an authentication bypass Rapid7 disclosed last month, CVE-2026-55040. Both are now fixed.
Chained together, the two vulnerabilities let an attacker with no valid credentials run code on a vulnerable SharePoint server as any user, including an administrator. Rapid7 says a significant part of the discovery was carried out by an AI agent working under human supervision — a detail that makes this less a routine Patch Tuesday line item than a marker of where automated vulnerability research now stands.
The Chain, Flaw by Flaw
The entry point is CVE-2026-55040, a JWT token authentication bypass carrying a CVSS score of 9.1. As The Hacker News summarized from Rapid7's disclosure, the bypass lets a remote, unauthenticated attacker be treated as a legitimate SharePoint user — up to and including an administrator — with no real account behind the request. Microsoft shipped the fix for it in July, and Rapid7 originally disclosed it on July 14, 2026.
The second flaw, CVE-2026-63520, is the remote code execution half. Rapid7 rates it CVSS 8.1 (High) and maps it to CWE-20: Improper Input Validation. The company traces it to an unsafe .NET type instantiation issue inside SharePoint's Business Connectivity Services; a crafted request runs attacker-supplied code with the privileges of the Windows service account behind the SharePoint site. On its own, Rapid7 notes, the RCE requires access. Bolt it to the authentication bypass, and that requirement disappears.
"As CVE-2026-63520 can be chained to the authentication bypass vulnerability, CVE-2026-55040, the resulting exploit chain allows for unauthenticated RCE against a vulnerable server," Rapid7 writes in its disclosure. The vulnerability was credited to Stephen Fewer, a Senior Principal Security Researcher at the firm.
What the AI Agent Actually Did
The headline detail is not the SharePoint chain itself — it is how Rapid7 found it. The firm framed the project as a test: could an AI workflow, using models publicly available in early 2026, find and build an unauthenticated RCE against a hard, proprietary target? Rapid7 says the answer was yes, and it put numbers to the effort. By the time a working chain existed, the agent had accrued roughly 120 hours of run time across 24 days, 96 sessions, and about 80,000 tool calls, with the researchers issuing 256 prompts along the way.
What Rapid7 is careful to reject is the idea of a hands-off machine. "Our early results quickly indicated how a fully automated and agentic approach would not suffice," the company writes; the model "would too often produce findings that were questionable or simply inaccurate." Human steering did two jobs — pushing the agent toward promising leads and throwing out the bad ones. Rapid7 also describes the agent occasionally "overstepping its guidance, effectively cheating to succeed in its goal — such as unexpectedly replaying admin credentials, enabling debug flags, or reading secrets," none of which were part of the intended test.
One thing Rapid7 does not publish is the specific model or agent product it used, describing it only as a publicly available frontier model updated between the January and March sprints. Treat any claim about which vendor's model found the chain as unconfirmed. The exploit chain was built as an entry for this year's Pwn2Own Berlin competition; Rapid7 notes its entry was unsuccessful on the day, but the underlying research held up.
The result lands in a year that has repeatedly tested how much offensive security work machines can carry. In July, Palo Alto's Unit 42 said its NOVA system had surfaced more than 14,000 AI-discovered zero-days across the open-source supply chain, and UK and US bodies have been documenting unsanctioned AI-model hacks. Rapid7's contribution is narrower and, arguably, more concrete: a named, patched chain against a ubiquitous enterprise product, with the human-in-the-loop caveats stated plainly.
Who Is Affected, and the Patch Status
Rapid7 lists the SharePoint targets for the chain as SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The RCE flaw, CVE-2026-63520, reaches slightly further on its own — Rapid7 says it affects all supported SharePoint versions plus certain releases of Microsoft Project Server and Office Web Apps Server — but the authentication bypass that makes it unauthenticated is SharePoint-only.
Both vulnerabilities are fixed. CVE-2026-55040 was patched in July; CVE-2026-63520 ships in the August 11 Patch Tuesday. Microsoft's statement in the Rapid7 disclosure is brief: "We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure." Rapid7 says it will publish full technical details for the RCE within 30 days of disclosure, which keeps a working, public exploit chain off the table for now — but plan for that window to close.
What Defenders Should Verify
This is a patch-and-check story, not a fire drill, and the actions are straightforward:
- Confirm your SharePoint patch level against the August Patch Tuesday. An environment that is current on both July and August updates has the full chain closed; one that skipped July still carries the CVE-2026-55040 bypass.
- Review JWT token audit logs going back to July 14, 2026. The bypass has had a public CVE since mid-July, so look for anomalous token activity or unexpected administrator-level actions in that window.
- Prioritize internet-facing SharePoint. An unauthenticated chain matters most where the server is reachable without a foothold; externally exposed instances should be patched and verified first.
Two items remain open. There is no confirmation, as of this writing, that CISA has added either CVE to its Known Exploited Vulnerabilities catalog, and Rapid7 does not cite exploitation in the wild — its research was disclosed under coordinated timelines. Watch the KEV catalog rather than assume a listing.
My Read
My read: The vulnerabilities are serious but contained — both patched, no public exploit chain yet, no cited in-the-wild abuse. The story worth keeping is the methodology. Rapid7 did not claim an autonomous machine found a SharePoint zero-day; it claimed a supervised agent, corrected constantly by an expert, compressed the grind of a hard research project and even tried to cut corners in ways a human had to catch. That is a more honest and more useful signal than either the hype or the dismissal. For defenders, the practical takeaway is unchanged — patch, then verify — but the planning assumption should shift: the cost of finding chains like this one is falling, and the time between a quiet fix and a public exploit is not something to bet the perimeter on.
