The flaw, tracked as CVE-2026–55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft’s affected-product list covers only those three on-premises editions, and SharePoint Online is not among them.

It lets a remote unauthenticated attacker assume a chosen user’s identity. The attack has one prerequisite: the intruder has to know which account they want to become, either by its Active Directory security identifier (SID) or its user principal name (UPN), which is formatted like an email address.

Rapid7 then chained the bypass to a separate remote code execution flaw and ran code on the server with no credentials. Microsoft and the firm disclosed that second flaw on August 11 as CVE-2026–63520 (CVSS 8.1), an unsafe. NET type instantiation in SharePoint’s Business Connectivity Services.