Cybersecurity agencies have issued urgent advisories following reports that threat actors are actively exploiting unpatched security flaws in Microsoft SharePoint. Enterprise administrators are advised to apply emergency updates immediately to prevent unauthorized remote access to organizational networks.

The attacks leverage remote code execution chains, allowing unauthenticated attackers to send specially crafted network requests to vulnerable SharePoint instances. Once targeted, affected systems enable bad actors to execute arbitrary commands, compromise internal document repositories, and pivot deeper into enterprise environments.

Microsoft SharePoint Zero-Day Vulnerabilities Face Active Exploitation

Security researchers recently identified targeted intrusions aimed at on-premises SharePoint deployments across corporate and public sector networks. According to telemetry collected by global intelligence firms, cybercriminals began leveraging these zero-day flaws before official patches could be widely distributed. The attack patterns indicate high-level coordination, with adversary groups actively scanning public IP ranges for exposed server instances.

Organizations relying on legacy network perimeter defenses are particularly exposed if external access to SharePoint endpoints remains unrestricted. These incidents come amidst a broader trend of threat actors targeting productivity suites and enterprise infrastructure, similar to how sophisticated operations such as the Mirage2FA phishing campaign hijacks Microsoft 365 accounts to bypass conventional authentication layers.

Active Attacks Target Critical Microsoft SharePoint Flaws

The core of the recent activity involves chaining multiple weakness types to achieve elevated privileges without requiring valid user credentials. Threat actors bypass initial access controls by manipulating web requests sent to server-side components responsible for handling web parts and internal templates.

Because SharePoint often maintains elevated permissions within Active Directory environments to access enterprise databases, compromising the application server often provides attackers with direct paths to sensitive corporate records, intellectual property, and internal communications.

Details on CVE-2026-55040 and CVE-2026-63520

The current advisory focuses on two primary security identifiers: CVE-2026-55040 and CVE-2026-63520. The first vulnerability, CVE-2026-55040, stems from improper validation of user-supplied input within SharePoint's core object model. Attackers can exploit this parameter handling flaw to bypass structural access checks.

The second vulnerability, CVE-2026-63520, involves an unsafe deserialization flaw present in legacy API endpoints. When combined, an unauthenticated remote attacker can trigger CVE-2026-55040 to navigate past network filters and subsequently execute arbitrary code via CVE-2026-63520. Both vulnerabilities carry high Common Vulnerability Scoring System ratings due to the lack of user interaction required for successful exploitation.

Authentication Bypass and Remote Code Execution Risks

The combination of authentication bypass and remote code execution presents severe operational risks. Attackers gaining execution rights on a SharePoint host can install persistent web shells, dump memory contents to extract credentials, and disable local monitoring tools.

This level of system access often leads to secondary operational impacts. Cybercriminals can execute lateral movement scripts across the broader domain, deploy ransomware, or quietly exfiltrate sensitive files over extended periods. System administrators are advised to inspect application logs for anomalous web requests, unexpected child processes spawned by web server daemons, and unexplained changes to system configuration files.

Security Response and Patch Deployment Steps

Microsoft has released security updates addressing both zero-day vulnerabilities across supported editions of SharePoint Server, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Cloud-hosted environments like SharePoint Online in Microsoft 365 have already received automated server-side mitigations and do not require administrator intervention.

For on-premises environments, security teams should execute the following remediation workflow immediately:

  • Apply the latest security updates released during the monthly patch cycle to all SharePoint web front-end and application servers.
  • Restrict public internet access to SharePoint management interfaces and limit inbound traffic to trusted networks or secure VPN connections.
  • Audit service accounts associated with SharePoint farm deployments to ensure they operate under the principle of least privilege.
  • Review IIS execution logs for unusual HTTP POST requests directed toward legacy API endpoints.

Rapid patch deployment remains critical. As software vendors refine their platforms, fast-tracked updates have become vital across enterprise stacks, much like how the Microsoft Edge team accelerated WebView2 updates to shorten vulnerability remediation windows.

Impact on Enterprise SharePoint Server Deployments

The discovery of active zero-day exploitation highlights the ongoing challenge of securing complex, on-premises business applications. Organizations running hybrid infrastructure must maintain rigorous asset inventories to ensure legacy servers receive critical security updates without delay.

While Microsoft continues to integrate advanced security controls across its ecosystem, legacy infrastructure vulnerabilities continue to attract top-tier threat actors. Organizations using affected SharePoint versions should prioritize immediate update installation, log analysis, and perimeter hardening to defend against unauthorized network intrusion.