Security researchers have disclosed an AI-assisted exploit chain targeting Microsoft SharePoint servers that reaches unauthenticated remote code execution. The chain begins with a flaw tracked as CVE-2026-55040 (CVSS 9.1), affecting SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. SharePoint Online is not affected. The vulnerability lets a remote unauthenticated attacker assume a chosen user's identity, provided the intruder knows the target account's Active Directory security identifier (SID) or user principal name (UPN). Rapid7 chained this bypass to a separate remote code execution flaw, disclosed on August 11 as CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in SharePoint's Business Connectivity Services. This second flaw affects Subscription Edition, 2019, and 2016, along with Project Server 2013 Service Pack 1 and Office Web Apps 2013 Service Pack 1. Rapid7 says the flaw is fixed, but Microsoft's SharePoint update history listed no August package at the time of writing. Rapid7 advises confirming the July update is installed, which breaks the chain, and applying the August update when it appears. CISA said on July 14 the bypass was not yet known to have been exploited. The bypass sits in SharePoint's JSON Web Token (JWT) validation pipeline. Rapid7's proof-of-concept queries the target's domain controller to enumerate users by S