Rapid7 and Microsoft have disclosed CVE-2026-63520, a remote code execution flaw in Microsoft SharePoint that completes an unauthenticated exploit chain Rapid7 Labs built for Pwn2Own Berlin. Senior Principal Security Researcher Stephen Fewer found it using an AI agent workflow, and Microsoft shipped the fix in its August 11 update cycle.
CVE-2026-63520 carries a CVSSv3.1 score of 8.1 (High) and is classified as CWE-20: Improper Input Validation. The root cause is an unsafe .NET type instantiation issue in Business Connectivity Services. Code runs with the privileges of the Windows service account behind the SharePoint Site instance. It affects all supported SharePoint versions, plus certain builds of Project Server and Office Web Apps Server.
How the CVE-2026-63520 Exploit Chain Works
On its own, the RCE needs an authenticated session. Paired with CVE-2026-55040 — the JWT token authentication bypass Microsoft patched on July 14 — that requirement disappears. An attacker forges a token, assumes a site user's identity, then crafts a custom .NET gadget chain to run an attacker-controlled OS command.
Rapid7's agent logged 120 hours of runtime across 24 days, 96 sessions, roughly 80,000 tool calls and 256 human prompts to reach a working chain. It is the same category of pre-auth SharePoint chain as ToolShell, which surfaced from Pwn2Own last year.
Which SharePoint Builds Are Fixed
| Product | Fixed build | KB |
|---|---|---|
| SharePoint Server Subscription Edition | 16.0.19725.20522 | KB5002893 |
| SharePoint Server 2019 | 16.0.10417.20198 | KB5002894, KB5002896 |
| SharePoint Enterprise Server 2016 | 16.0.5565.1001 | KB5002905, KB5002906 |
The 30-Day Clock Already Started
Rapid7 will publish full technical details for CVE-2026-63520 within 30 days — roughly September 10. Treat that as a hard deadline, because the first half of this chain just demonstrated the pattern.
Rapid7 released its CVE-2026-55040 write-up and PoC on August 11. Threat intelligence firm Defused reported the next day that its honeypots were recording exploitation attempts using that exact PoC. "Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots," Defused stated. Shadowserver still tracks more than 8,500 SharePoint servers exposed online, and neither CVE appears in CISA's Known Exploited Vulnerabilities catalog at the time of writing — though SharePoint flaws have a history of landing there.
Publication to weaponisation took one day. Administrators have until early September before the RCE half gets the same treatment. Both patches, not one.