An AI-Assisted SharePoint Hunt Became a Full Exploit Chain

Microsoft’s August 11 security release completed the fix for a two-vulnerability SharePoint Server chain developed by Rapid7 Labs. The first flaw, CVE-2026-55040, is a critical JSON Web Token validation weakness patched in July. Rapid7 says it can let a remote unauthenticated attacker impersonate a known SharePoint user or administrator. The second flaw, CVE-2026-63520, supplies the remote-code-execution step patched in August.

Rapid7 disclosed the chain to Microsoft in May through coordinated vulnerability disclosure. The company says applying the July fix for the authentication bypass already broke the full chain; the August release now addresses the RCE component itself. This is a vulnerability-research disclosure, not evidence that the chain was used in a confirmed attack. Defenders should not conflate working research with observed exploitation.

The agent did substantial work inside a human research program

Rapid7 says the project ran in two sprints, one in January and one in March. Across 24 active days, researchers used 96 agent sessions, wrote 256 prompts, and generated roughly 80,000 agentic tool calls. The first sprint found no usable chain. The second, using improved models and workflows, produced the two-vulnerability path to unauthenticated code execution.

Those details resist two simplistic readings. The agent was not merely autocomplete: thousands of tool calls across a large, complex codebase represent meaningful search and analysis. But it was not an unsupervised system dropped onto the internet either. Rapid7 describes manual code review, reverse engineering, heavy prompting, workflow experimentation, human validation, and responsible disclosure around the agent.

The improvement between sprints is especially important. Better models may account for part of the gain, but researchers also learned how to structure the work. Agent performance is a property of the whole harness: target preparation, tools, context management, decomposition, feedback, stopping rules, and expert review all affect what the model can accomplish.

Chaining turns limited flaws into system-level risk

CVE-2026-55040 shows why an authentication bypass cannot be judged only by its immediate action. Rapid7 says an attacker needs advance knowledge of a target identity, such as an Active Directory Security ID or user principal name. Once impersonation succeeds, however, the attacker reaches the much larger authenticated attack surface and can combine that access with a separate code-execution weakness.

Security programs often prioritize isolated severity scores, yet real compromise paths cross identity, application, and operating-system boundaries. AI agents are well suited to exploring these compositions because they can keep testing relationships across many files and endpoints. That same breadth makes containment essential: research agents should work in instrumented labs with no production credentials, narrow network access, and explicit target authorization.

For vendors, more agent-assisted findings may increase disclosure volume and shorten the distance between obscure code paths and working demonstrations. Patch engineering, regression testing, coordinated timelines, and customer communication must scale alongside discovery. Finding faster is useful only when the defensive pipeline can convert findings into deployed fixes.

Patch status matters more than the AI headline

Organizations running affected on-premises SharePoint Server versions should use Microsoft’s current Security Update Guide to identify and install the applicable cumulative updates. SharePoint Online is a separate hosted service and should not be assumed affected by an on-premises Server advisory. Administrators should verify successful installation and inventory any internet-exposed servers rather than treating a scheduled patch job as proof of coverage.

Because the July authentication fix breaks the described chain, teams that applied it promptly already reduced this specific path before the second CVE became public. The August update still matters as defense in depth and because vulnerabilities can be combined in ways the original researchers did not test. Unsupported installations and systems that cannot be updated should not remain directly exposed.

The broader signal is that expert vulnerability research is becoming more parallel and persistent. Defenders should plan for higher finding rates without exaggerating AI autonomy or treating every disclosure as active exploitation. The operational response remains familiar: maintain an accurate asset inventory, follow vendor advisories, test and deploy updates quickly, isolate high-risk services, and investigate credible signs of compromise.