Researchers Found a Way to Break Into SharePoint With No Credentials

Michael Miller · 2026-08-11

It's the kind of headline that makes you want to double-check your server logs. Security researchers have uncovered a method to break into Microsoft SharePoint servers as any user, including a full administrator, without ever needing a valid account. And here's the kicker: a significant chunk of the discovery work was handled by an AI agent, not a human staring at code for weeks on end. The flaw, tracked as CVE-2026-55040, carries a CVSS score of 9.1, which puts it firmly in the "drop everything and patch" category. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft has acknowledged the issue, but the sheer scope of the attack chain is what makes this one so unsettling. ### What Exactly Is the Vulnerability? At its core, this isn't a single bug that lets you walk in the front door. It's an exploit chain—a series of separate weaknesses that, when stitched together, give an attacker unauthenticated remote code execution (RCE). That means someone with zero access to your network can execute code on your SharePoint server, potentially taking over the entire system. The researchers didn't just stumble onto this. They used an AI agent to help map out the attack surface, identify potential weak points, and string together the steps needed to reach full compromise. It's a sign of things to come: AI isn't just writing blog posts or generating images anymore. It's actively hunting for vulnerabilities in enterprise software. ### Why Should You Care? If you're running SharePoint on-premises, this is your wake-up call. An attacker can impersonate any user, including domain admins, without a single credential. That means they could read sensitive documents, modify site content, or deploy malicious code that persists long after the initial breach. Here's a quick rundown of what's at stake: - **Data theft**: Any file stored on the SharePoint server could be exfiltrated. - **Lateral movement**: Once inside, attackers can pivot to other systems on your network. - **Ransomware risk**: With admin-level access, deploying ransomware becomes trivial. - **Compliance headaches**: If you handle regulated data, a breach like this could trigger fines and audits. ### What Can You Do Right Now? First, check your version. If you're running SharePoint Server Subscription Edition, 2019, or 2016, you need to see if Microsoft has released a patch. If a fix is available, apply it immediately. If not, you should consider temporary mitigations like restricting network access to the server or enabling additional authentication layers. Second, review your audit logs. Look for any unusual activity, especially login attempts that don't match known users. The exploit leaves a trail, but you have to know where to look. Third, and this might sound odd, but start thinking about how AI is changing the threat landscape. Attackers are going to use these same techniques to find flaws faster than ever. Your security team needs to be proactive, not reactive. ### The Bigger Picture This isn't just about SharePoint. It's a glimpse into the future of cybersecurity. AI-assisted vulnerability discovery is going to become the norm, both for defenders and attackers. The researchers who found this flaw did the right thing by disclosing it, but the next group might not be so generous. For now, the takeaway is simple: patch your servers, monitor your logs, and don't assume your on-premises infrastructure is safe just because it's behind a firewall. The bad guys are getting smarter, and now they've got AI on their side too. Stay vigilant, keep your systems updated, and maybe have a conversation with your IT team about how they're planning to handle the next wave of AI-powered attacks. Because it's not a matter of if—it's a matter of when.