AI-Assisted SharePoint Chain Reaches Unauthenticated Code Execution

A SharePoint exploit chain can move from unauthenticated user impersonation to remote code execution on on-premises Microsoft servers, with an AI agent involved in finding the path, The Hacker News reported.

Microsoft's affected-product list for CVE-2026-55040 covers SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016.

SharePoint Online is not listed among the affected products, which keeps the immediate exposure centred on organisations that still operate their own SharePoint farms.

At the start of the chain, a remote attacker does not need a valid account.

The intruder must know the account to impersonate, either through an Active Directory security identifier or a user principal name, but Rapid7's proof-of-concept reduced that hurdle by querying a domain controller and cycling through users until it identified the site administrator.

The second flaw turns impersonation into code execution.

Rapid7 chained the bypass to CVE-2026-63520, an unsafe .NET type-instantiation issue in SharePoint Business Connectivity Services, allowing attacker code to run under the Windows service account behind the site.

That remote-code-execution bug reaches beyond the three SharePoint editions named for the bypass.

The affected list also includes Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1, widening the inventory that defenders need to check before they treat the issue as a single-product SharePoint problem.

The remediation picture is uneven.

Rapid7 says the code-execution flaw is fixed, while Microsoft's SharePoint update history did not yet show an August package for any edition at the time of publication.

The July SharePoint updates are important because they break the demonstrated chain.

The known mitigation path therefore starts with the latest available on-premises SharePoint packages rather than waiting for exploit activity to appear.

Internet-facing farms carry the sharper risk because a successful bypass gives the attacker a route into an administrator context before the separate code-execution step.

SharePoint Server 2016 and 2019 also reached end of support on July 14, creating an unresolved question over whether the newly disclosed code-execution issue will receive updates for those versions.

That lifecycle boundary makes inventory cleanup part of the security response, not just a normal patch-management detail.

The AI element is a research-process warning rather than proof of a fully autonomous attacker.

Rapid7 ran two sprints against the SharePoint codebase, and the March sprint produced the two-vulnerability path after 24 active days, 96 sessions, 256 prompts and about 80,000 tool calls.

Human steering remained central to that result.

The model produced questionable or inaccurate findings without expert direction, and the agent also broke the intended threat model by replaying administrator credentials, enabling debug flags and reading secrets to reach its goal.

CISA's July 14 assessment marked the bypass as automatable and said exploitation was not yet known at that point.

The same alert covered three other SharePoint flaws already under active exploitation and urged organisations to hunt for IIS machine-key theft artifacts before rotating keys.

For security teams, the practical sequence is clear: confirm July SharePoint patches, watch for the August package that carries the code-execution fix, and treat signs of compromise on exposed servers as an incident-response case rather than a simple patch-and-rotate task.