Skip to content
OriginalSign in
Image: Rapid7

Rapid7Stephen Fewer

Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass

Part of the Rapid7 story · since 7 Aug

Quiet for 11 weekslast report 25 Aug9 articles4 outlets
7 Aug · Rapid7 first8 Sep24 Sep10 Oct26 OctNowThis article2nd of 9
  • Fri 7 Aug, 18:52 UTC. Rapid7, first report. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 14:51 UTC. Rapid7. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass. This article, 2nd of 9.
  • Tue 11 Aug, 14:51 UTC. Rapid7. CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:52 UTC. SecurityOnline, its first report on the story. Critical SharePoint JWT flaw lets attackers bypass authentication. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 09:21 UTC. Security Affairs, its first report on the story. SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release. Cites a CVE in CISA KEV.
  • Fri 14 Aug, 12:07 UTC. SecurityWeek, its first report on the story. FBI investigates North Korean IT worker breach of US agency.
  • Tue 18 Aug, 13:08 UTC. SecurityWeek. Rapid7 Warns AI Driven Flaws Surge, Patching Falls Short.
  • Fri 21 Aug, 09:31 UTC. SecurityOnline. Rapid7 Exposes Global Crypto Scam Using Phishing Vishing and AI.
  • Tue 25 Aug, 00:11 UTC. Rapid7. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).

The Rapid7 blog post discusses the recently fixed vulnerability CVE-2026-63520, a Remote Code Execution (RCE) flaw in Microsoft SharePoint discovered through research by Rapid7 Labs. The vulnerability can be exploited to execute arbitrary code on affected SharePoint servers. It is the second in a chain with CVE-2026-55040, which is an authentication bypass vulnerability. Both issues were disclosed collaboratively between Rapid7 and Microsoft, with the first flaw disclosed previously.

The RCE vulnerability has a CVSSv3.1 score of 8.1 (High) and can allow an attacker to perform significant operations with the service account's privileges. Rapid7 will host a webinar on August 13, 2026, covering these findings, and customers are advised to apply updates to protect against the vulnerabilities. The article also includes a detailed disclosure timeline and technical analysis.

How the story developed

All 9 articles
Quiet for 11 weekslast report 25 Aug9 articles4 outlets

9 articles from 4 outlets since 7 Aug. Quiet since 25 Aug. This was the 2nd report, 4 days after the first.

Now7 Aug101214161820222426First reportRapid7 · 7 Aug, 18:52This article2nd of 9 · day 4
  • Fri 7 Aug, 18:52 UTC. Rapid7, first report. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 14:51 UTC. Rapid7. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass. This article, 2nd of 9.
  • Tue 11 Aug, 14:51 UTC. Rapid7. CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:52 UTC. SecurityOnline, its first report on the story. Critical SharePoint JWT flaw lets attackers bypass authentication. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 09:21 UTC. Security Affairs, its first report on the story. SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release. Cites a CVE in CISA KEV.
  • Fri 14 Aug, 12:07 UTC. SecurityWeek, its first report on the story. FBI investigates North Korean IT worker breach of US agency.
  • Tue 18 Aug, 13:08 UTC. SecurityWeek. Rapid7 Warns AI Driven Flaws Surge, Patching Falls Short.
  • Fri 21 Aug, 09:31 UTC. SecurityOnline. Rapid7 Exposes Global Crypto Scam Using Phishing Vishing and AI.
  • Tue 25 Aug, 00:11 UTC. Rapid7. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Fri 7 AugDay 01
    1. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)18:52 · Rapid7 · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 4 days

    Tue 11 AugDay 42
    1. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass14:51 · Rapid7 · Picked up again · This article, 2nd of 9
    2. CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens14:51 · Rapid7 · Known exploited CVE
  3. Wed 12 AugDay 51
    1. Critical SharePoint JWT flaw lets attackers bypass authentication09:52 · SecurityOnline · Known exploited CVE
  4. Thu 13 AugDay 61
    1. SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release09:21 · Security Affairs · Known exploited CVE
  5. Fri 14 AugDay 71
    1. FBI investigates North Korean IT worker breach of US agency12:07 · SecurityWeek

  6. Quiet for 4 days

    Tue 18 AugDay 111
    1. Rapid7 Warns AI Driven Flaws Surge, Patching Falls Short13:08 · SecurityWeek · Picked up again

  7. Quiet for 3 days

    Fri 21 AugDay 141
    1. Rapid7 Exposes Global Crypto Scam Using Phishing Vishing and AI09:31 · SecurityOnline · Picked up again

  8. Quiet for 4 days

    Tue 25 AugDay 181
    1. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)00:11 · Rapid7 · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in