A hacker used to need something from you to get in. A stolen password. A click on the wrong link. A weak spot an employee accidentally left open. That’s no longer a safe assumption.
In August 2026, security researchers disclosed a way to fully compromise on-premises Microsoft SharePoint servers without any of that. No credentials. No phishing email. No employee action required at all. Two separate vulnerabilities, used together, let an attacker walk straight in and start running their own commands on the server.
If your business runs SharePoint on its own infrastructure, here’s what actually happened, why it matters, and what to check first.
What Actually Happened
Researchers at Rapid7 found that two SharePoint vulnerabilities, when used one after the other, add up to something much worse than either flaw alone. The first flaw lets an attacker bypass authentication entirely — meaning they can act as a real, valid user on your system without ever knowing that user’s password. The second flaw takes that access and uses it to run arbitrary code on the server itself.
Neither vulnerability on its own would necessarily make headlines. Chained together, they form what security professionals call an “exploit chain” — a sequence where each step unlocks the next, ending in full server compromise. This particular chain affects on-premises deployments of SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. SharePoint Online, Microsoft’s cloud-hosted version, is not affected.
Why “Unauthenticated” Should Get Your Attention
In security terminology, “unauthenticated” is one of the most serious words you can see in a vulnerability report. It means an attacker doesn’t need a foothold of any kind to start the attack — no employee credentials, no insider access, no social engineering. They just need your server to be reachable and unpatched.
For a business owner, the practical takeaway is this: the usual advice about training employees to spot phishing emails, while still important, doesn’t protect you from this particular threat. This one lives entirely in the software itself.
What to Do Now
The good news is that Microsoft has released patches addressing both vulnerabilities in the exploit chain. The action item for your business is straightforward, even if it requires a conversation with whoever manages your IT environment:
Confirm whether your organization runs SharePoint on-premises (rather than the cloud-based SharePoint Online). If so, confirm that the relevant security updates have been fully applied — not just scheduled, but actually installed and verified across every server in your environment. Attackers move quickly once a vulnerability like this becomes public, and confirming a patch was applied is different from assuming it was.
If you’re not sure how to answer either of those questions confidently, that uncertainty is itself worth addressing. A vulnerability assessment is designed to give you exactly that kind of clarity — a clear picture of what’s exposed in your environment and what needs attention first, rather than guessing.
The Bigger Pattern Worth Noticing
This isn’t an isolated incident. On-premises SharePoint has seen a wave of serious vulnerabilities disclosed throughout 2026, several of them actively exploited before organizations had a chance to patch. That pattern is a useful reminder that vulnerability management isn’t a once-a-year task — it’s ongoing. Businesses that treat security as something to check on periodically, rather than something actively managed, tend to be the ones caught off guard when a story like this breaks.
That’s often where a vCISO becomes valuable — not as someone who reacts to headlines, but as someone whose job is to already know whether a story like this applies to your business before you have to ask.
Frequently Asked Questions
What does “unauthenticated remote code execution” mean in plain English?
It means an attacker can run their own commands on your server without ever logging in or having valid credentials. It’s one of the most serious categories of vulnerability because it removes the need for any prior access to your systems.
Does this affect SharePoint Online (Microsoft 365)?
No. This vulnerability chain affects on-premises versions of SharePoint Server only — Subscription Edition, 2019, and 2016. Cloud-hosted SharePoint Online is not affected.
How do I know if my business is at risk?
If your organization runs SharePoint on servers you manage (rather than through Microsoft 365), you should confirm the relevant patches have been applied. If you’re unsure how to check, a vulnerability assessment can identify exposure across your environment.
Is patching enough to protect against this?
Patching addresses the specific vulnerabilities in this exploit chain, but ongoing vulnerability management is what prevents the next one from catching you off guard. Treating security patching as a continuous process, rather than a one-time fix, is the more durable approach.