Researchers Complete a Pre-Auth SharePoint RCE Chain as Poland Discloses a Second Power Plant Intrusion

Microsoft's August Patch Tuesday closed out an exploit chain that security researchers had been tracking since mid-July. Rapid7 Labs disclosed CVE-2026-55040, a critical JWT token validation flaw in on-premises SharePoint Server, back on July 14 — it let a remote, unauthenticated attacker forge a valid token and impersonate any site user, including an administrator, as long as they knew the target's Active Directory security identifier or user principal name. Patching that flaw alone broke the attack at its first stage. But Rapid7 had already chained it to a second vulnerability to demonstrate full unauthenticated remote code execution, and that second flaw, an unsafe .NET type instantiation in SharePoint's Business Connectivity Services tracked as CVE-2026-63520, stayed embargoed until this week. Microsoft shipped the fix for it in today's patch cycle, meaning any organization that only applied July's update has been running with half the chain still open. Both CVEs affect SharePoint Server Subscription Edition, 2019, and 2016; SharePoint Online was never in scope. Part of the discovery work behind the exploit chain reportedly involved an AI research agent, though the core vulnerabilities were identified and validated by Rapid7's own security researchers.

The urgency here isn't hypothetical. Storm-2603, the group behind Warlock ransomware, has been hunting internet-facing SharePoint servers since mid-2025, and CISA has separately confirmed ransomware actors abusing a related, earlier SharePoint deserialization RCE that's been under active exploitation since early July. That group has already shown its post-exploitation playbook on SharePoint: DLL search-order hijacking, Cloudflare Tunnel for command-and-control, and VS Code's remote-SSH feature abused for persistence. For SOC teams running on-prem SharePoint, the practical checklist is short: confirm August's patches are actually installed on every farm server (not just downloaded), and hunt specifically for the persistence techniques Storm-2603 is already known to use, since a patched server doesn't retroactively evict an attacker who got in beforehand.

Separately, Poland's CERT disclosed on August 8 a second cyberattack against energy infrastructure, following one the prime minister had already confirmed in January. This latest incident, which actually occurred in December 2025, saw an attacker pivot from a compromised wind farm network into a combined heat-and-power (CHP) plant's control systems. The route ran through a private APN, a dedicated cellular data network operated by the distribution system operator, where a configuration flaw let arbitrary devices on that network communicate with each other. That misconfiguration is what let the intruder move from the wind farm's network to a controller inside the CHP plant. Recovery efforts began around 7:30 a.m. local time while the intruders were still active inside the network, and CERT Polska says customers lost neither heat nor electricity throughout. The investigation took more than three months to complete before disclosure. For any organization running OT alongside cellular/APN-connected remote sites, the lesson is specific: a private APN is not automatically a segmented network, and device-to-device communication within it needs the same scrutiny as segmentation between IT and OT.

CISA also flagged two more vulnerabilities under active exploitation in the past few days. A critical command injection flaw in Progress Kemp LoadMaster is being actively exploited, and a local privilege-escalation bug in Windows' Ancillary Function Driver for WinSock, tracked as CVE-2026-68820, is seeing active exploitation as well; researchers note the same driver component has been a recurring target for privilege-escalation bugs throughout 2026. And on the supply-chain side, researchers disclosed a compromise affecting BdThemes, a WordPress plugin vendor, prompting WordPress.org to temporarily pull the vendor's plugin downloads while the investigation continues — a reminder that plugin ecosystems remain one of the more efficient ways to compromise a large number of otherwise well-maintained sites at once.