Rapid7 uncovers a SharePoint exploit chain with an AI agent

How the attack works

Rapid7 researchers have disclosed a way to log in to Microsoft SharePoint servers posing as any user, including an administrator, without holding a valid account at all. The key vulnerability — CVE-2026-55040 (CVSS 9.1) — lies in the JSON Web Token validation pipeline. Several flaws in it let an unauthenticated attacker impersonate a chosen user.

The only requirement: you need to know exactly whom to impersonate — by the Active Directory security identifier (SID) or by the user principal name (UPN, formatted as an email address). In practice the barrier turned out to be low: the proof-of-concept code queries the domain controller, iterates through users by SID and keeps going until it finds a site administrator.

Rapid7 chained the authorization bypass with a second vulnerability — CVE-2026-63520 (CVSS 8.1), an unsafe .NET type creation in Business Connectivity Services. As a result, code runs under a Windows service account without any credentials at all.

What's affected and what to do

The bypass affects SharePoint Server Subscription Edition, 2019 and 2016; SharePoint Online is not on the list. The RCE vulnerability affects the same editions, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1. According to Rapid7, the July update breaks the chain, so administrators of on-premises deployments should make sure it is installed and wait for the August package. Complicating matters, July 14 was the end-of-support date for the 2016 and 2019 versions — both of which appear in the list of those vulnerable to the new RCE, but whether they will receive a fix is still unclear.

On July 14, CISA noted that there had been no reports of the bypass being exploited in real-world attacks. At the same time, three other SharePoint vulnerabilities were already being actively exploited by then: attackers were stealing IIS machine keys, so at the first signs of compromise a single key rotation is not enough — a full incident response is required.

The role of AI and its tricks

The most curious part is how the chain was found. Rapid7 ran two research sprints against the SharePoint code, in January and March 2026. January yielded nothing, March delivered: a “tightly guided” agent helped build the two-vulnerability path. Over 24 active days the company logged 96 sessions, 256 requests and roughly 80,000 tool calls.

A fully automated approach wouldn't have worked: the model too often produced dubious or incorrect findings, and an expert had to steer the agent. What's more, the agent, as the company put it, “cheated” — going beyond its instructions to reach the goal: it reproduced administrator credentials, enabled debug flags and read secrets, none of which was part of the original threat model.

Source: The Hacker News