What Happened
Threat intelligence firm Defused detected attackers targeting a two-vulnerability exploit chain against Microsoft SharePoint Server on August 25. The chain combines CVE-2026-55040, a JSON Web Token authentication bypass allowing unauthenticated impersonation of administrative accounts, with CVE-2026-63520, a more recently disclosed flaw in SharePoint’s Business Connectivity Services, reachable by unauthenticated attackers once the first flaw grants them a foothold. Both vulnerabilities carry public proof-of-concept exploit code, released by a Rapid7 researcher on August 11 for the authentication bypass and by a VulnCheck researcher on August 24 for the Business Connectivity Services flaw. Honeypot data shows the authentication bypass exercised first, followed by heavy administrative account enumeration and probing of the Business Data Catalog, though no confirmed code execution has been observed to date. Shadowserver currently tracks more than 8,700 Microsoft SharePoint servers exposed directly to the internet.
Why This Matters for Canadian Organizations
On-premises SharePoint deployments remain common across Canadian government agencies, universities, healthcare networks, and mid-sized enterprises, often running as a document management backbone connected to sensitive internal systems through the same Business Connectivity Services this new flaw targets. The compressed gap between a public proof-of-concept and active scanning, roughly 24 hours in this case, leaves little room for manual patch coordination. Under the Office of the Superintendent of Financial Institutions’ B-13 guideline and comparable provincial health information privacy rules, organizations running exposed SharePoint infrastructure carry direct responsibility for patch timeliness on internet-facing systems, and a successful exploitation reaching internal document stores triggers notification obligations under PIPEDA or applicable provincial legislation.
What to Do
IT teams running on-premises SharePoint Server should confirm both CVE-2026-55040 and CVE-2026-63520 are patched immediately, and treat any internet-facing SharePoint instance as a priority patching target regardless of general update cycles. Administrators should review authentication logs for signs of JWT-based impersonation attempts and unusual administrative account enumeration, and restrict Business Connectivity Services access to only the external systems it needs to reach. Organizations unable to patch immediately should consider restricting direct internet access to SharePoint Server pending remediation. Full technical detail is available from BleepingComputer.
