AI Weekly Malaysia

Rapid7 researchers disclosed an unauthenticated RCE chain in on-premises Microsoft SharePoint (CVE-2026-55040 CVSS 9.1 for identity bypass, CVE-2026-63520 CVSS 8.1 for RCE via unsafe .NET type instantiation in Business Connectivity Services), affecting SharePoint Server Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1. A significant portion of the vulnerability research was performed by an AI agent. SharePoint Online is not affected, and the July update breaks the chain while the August fix build numbers are not yet public.

Why: If you run on-premises SharePoint, confirm the July update is installed immediately and watch for the August package—Rapid7 says the chain is fixed but Microsoft had not yet published the patched build numbers at disclosure time. For everyone else, the notable detail is that an AI agent materially contributed to finding a CVSS 9.1 exploit chain, which signals that AI-assisted security research is producing real, high-severity results rather than toy demos.

A critical SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) patched in Microsoft's July 2026 Patch Tuesday is now being actively exploited after Rapid7 released a Python proof-of-concept. The flaw chains four weaknesses in SharePoint's JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2) to let an unauthenticated attacker forge a valid Bearer S2S token and impersonate any site user or administrator.

Why: If your organization runs on-prem SharePoint and has not applied the July 2026 patch, patch immediately or restrict external access—public PoC code means exploitation is now trivial. For most SaaS founders and AI builders not running SharePoint, this is not actionable; the only transferable lesson is the JWT validation anti-pattern (accepting 'alg: none', not verifying x5t thumbprints against trusted issuers), worth checking in your own token-handling code.