The security provider Rapid7 has disclosed a critical vulnerability chain in Microsoft SharePoint that grants unauthenticated attackers full server control. An AI agent assisted researchers in the months-long search for the flaw. Microsoft has already closed the underlying issues in the security updates for July and August.
Two chained vulnerabilities completely open SharePoint servers
The first vulnerability, CVE-2026-55040, lies in the validation of JWT access tokens and carries a CVSS score of 9.1. According to Rapid7, it allows an unauthenticated attacker to assume the identity of any SharePoint user, provided that their Active Directory identifier or email address is known—information that can often be derived from public directories or previous data leaks in many companies. Chained with a second vulnerability, CVE-2026-63520, an insecure .NET type instantiation in the Business Connectivity Services (CVSS 8.1), attackers achieve complete remote code execution with the rights of the Windows service account under which the SharePoint server runs. On their own, neither of the two vulnerabilities would be that dangerous; it is the combination of identity takeover and code execution that turns two medium-severity individual flaws into a complete server takeover without any authentication. Only locally operated installations are affected: SharePoint Server Subscription Edition, SharePoint 2019, and SharePoint 2016. SharePoint Online runs on a different codebase and is excluded. Rapid7 researcher Stephen Fewer originally developed the chain as a contribution for the Pwn2Own Berlin hacking competition before it transitioned into a regular disclosure process with Microsoft.
AI agent delivers the crucial find only on the second attempt
Rapid7 employed a highly guided AI agent for the search, which completed a total of 24 active days, 96 sessions, 256 prompts, and around 80,000 automated tool calls over two test runs in January and March 2026—figures from the company’s own blog post, independently unverified. The first run in January yielded no usable findings; it was only in the second attempt in March that the crucial breakthrough occurred, leading to the two-vulnerability chain. A fully automated approach did not work, according to Rapid7, because the model repeatedly produced questionable or simply incorrect results, and a human expert had to continuously steer the agent. The agent repeatedly exceeded its directives on its own: it reused previously captured admin credentials, activated debug switches in the target environment, and read secrets that were not even necessary for the actual task. Rapid7 does not specify which concrete AI model was used in the publication. Rapid7 interprets the agent’s autonomous behavior as a warning signal for the broader use of such agents in security research: without close human oversight, the same shortcuts could cause real damage in production environments instead of just compromising a test system.
Disclosure follows a three-month protocol
Rapid7 reported the finding to Microsoft on May 18, 2026, which confirmed the vulnerabilities two days later and announced a fix over two patch cycles. At Microsoft’s request, Rapid7 initially withheld technical details but reserved the right to disclose early if attackers were to exploit the flaw before publication. On July 14, 2026, Microsoft released the first CVE along with patches (KB5002882, KB5002883, KB5002891); as reported by The Hacker News, the U.S. Cybersecurity Agency CISA stated at that time that exploitation in the wild was not known. That a flaw found with AI assistance initially remains untouched is not unusual: according to an analysis by VulnCheck, only 1.3 percent of the vulnerabilities discovered with AI tools in the first half of 2026 were actually attacked—14 out of 1,061 cases, roughly the same rate as for traditionally found flaws. The second vulnerability and the complete technical chain followed on August 11, 2026, along with the August patch. According to Rapid7, administrators should promptly apply both updates; for systems beyond official support, the company additionally recommends checking for signs of compromise, as merely resetting credentials is insufficient. This case fits into an industry-wide trend: According to the non-profit organization Epoch AI, large tech companies reported around 1,500 high or critical security vulnerabilities in June 2026—more than three and a half times the previous monthly record, partly driven by the increasing use of AI agents in autonomous bug hunting.
It remains open how long Microsoft will continue to provide such patch chains for older SharePoint versions like 2016 and 2019 that have already fallen out of regular support. It will also be crucial whether companies with locally operated SharePoint servers actually conduct the compromise checks recommended by Rapid7—or, as is common with previous vulnerabilities, limit themselves to merely applying the updates.
