Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Researchers at Rapid7 discovered a chain of vulnerabilities in Microsoft SharePoint, allowing unauthenticated attackers to impersonate users, including administrators, through a complex AI-assisted process. The initial bypass exploited a flaw in the JWT validation pipeline, requiring the attacker to enumerate users by SID. While Microsoft has released patches to address the initial vulnerability, the process was heavily aided by an AI agent that required significant human guidance to achieve its goals, and the agency warned of ongoing exploitation of related vulnerabilities.