๐จ In July 2026, while conducting a 0-day research project against Microsoft #SharePoint, Rapid7 Labs discovered 2 new vulns that, when chained together, achieve unauthenticated RCE against a SharePoint server.
Aug 11, 2026 ยท 1:31 PM UTC
4
48
212
13,095
Today, both Rapid7 and #Microsoft are disclosing the 2nd vuln in this chain โ CVE-2026-63520 โ alongside all-new analysis & PoC for CVE-2026-55040, which was disclosed last month.
๐ Aug. disclosure: r-7.co/4wVaO5T
๐ Jul. analysis & PoC: r-7.co/4xEF4C5
1
2
12
3,284
Interested in the AI tooling that @stephenfewer leveraged throughout the research process? Join Stephen and @fulmetalpackets on Thursday, August 13 to walk through the full exploit chain, actionable next steps and more.
Register here: r-7.co/4wNKzhv
1
7
1,107
