Blog
Auth bypass plus RCE partner: reporting chains the way ProxyShell taught us
Authentication bypass paired with remote code execution is a compound finding that requires compound reporting. ProxyShell established the template in 2021. SharePoint JWT forgery and Plex2Shell in 2026 follow the same pattern. The chain narrative changes severity, remediation urgency, and client understanding.
Web apps · Operator triage
ProxyShell (CVE-2021-34473 + CVE-2021-34523 + CVE-2021-31207) was three Exchange vulnerabilities chained into unauthenticated remote code execution. The individual CVEs were significant. The chain was a different conversation: an unauthenticated attacker on the internet could reach an Exchange server and execute code as SYSTEM. Orange Tsai's DEF CON 29 presentation showed how the chain worked.
ProxyShell established a template for reporting and understanding compound vulnerability chains that is more useful than any individual CVE rating. The auth bypass + RCE pattern recurs. October 2026 provides two new case studies.
The compound finding structure
An authentication bypass paired with a remote code execution is not two findings — it is one compound finding with a specific severity model:
Auth bypass alone: gains access to authenticated functions, data, or APIs
RCE alone (post-auth): executes code, but requires prior authentication
Auth bypass + RCE together: unauthenticated code execution -- attacker does not need a credentialThe CVSS score for the compound chain is computed for the worst-case combined path. Reporting the two CVEs separately with individual CVSS scores undersells the combined impact. A medium auth bypass (CVSS 6.5) feeding a high post-auth RCE (CVSS 8.1) produces an unauthenticated RCE chain — which reports at Critical, not at the average of the two scores.
ProxyShell anatomy (the reference chain)
| Step | CVE | Class | Mechanism |
|---|---|---|---|
| 1 | CVE-2021-34473 | SSRF + path confusion | Exchange's autodiscover backend proxied requests with path confusion — access to backend as NT AUTHORITY\SYSTEM |
| 2 | CVE-2021-34523 | Authentication bypass | Exchange PowerShell backend: X-Rps-CAT header manipulation bypasses auth; arbitrary Exchange cmdlets accessible |
| 3 | CVE-2021-31207 | Post-auth RCE (file write) | New-MailboxExportRequest cmdlet writes attacker-controlled content to web-accessible path; webshell execution |
The chain requires no credentials. Step 1 + Step 2 authenticate as any Exchange user via SSRF + header manipulation. Step 3 writes the webshell. The three CVEs are individually rated CVSS 7.2, 9.0, and 7.5. The compound chain is a universal unauthenticated RCE on Exchange — a Critical finding by any measure.
2026 chains that follow the same pattern
SharePoint JWT forgery + API access (CVE-2026-55040)
CVE-2026-55040 is an authentication bypass: the JWT validator fails open, accepting forged tokens with attacker-controlled identity claims. The "RCE partner" in this case is not direct code execution — it is SharePoint's REST API and Central Administration access.
| Step | Type | Mechanism | Impact |
|---|---|---|---|
| 1 | Auth bypass | JWT validator fails open; forged token accepted | Authenticated SharePoint session as any identity |
| 2 | Privilege escalation | Forge token as Farm Administrator or Site Collection Admin | Central Administration access; service account credential exposure |
| 3 | Lateral movement | SharePoint service account to AD privilege escalation | Domain-level access from SharePoint farm admin context |
The chain is auth bypass → privilege escalation → lateral movement. Without the bypass, step 2 requires a real Farm Admin credential. With it, any attacker position that can reach SharePoint (internet-facing or internal) is sufficient.
Plex2Shell (CVE-2026-96652 + CVE-2026-96656)
The Plex chain starts with unauthenticated SSRF (the bypass) and ends with arbitrary file write to code execution:
| Step | CVE | Type | Mechanism |
|---|---|---|---|
| 1 | CVE-2026-96652 | SSRF (pre-auth) | Metadata fetch endpoint follows attacker URLs without auth |
| 2 | CVE-2026-96655 | SSRF pivot | SSRF reaches loopback Plex management API — loopback trust as auth bypass |
| 3 | CVE-2026-96656 | RCE via file write | Management API writes payload; Plex execution context runs it |
The bypass is implicit: the Plex management API trusts loopback connections without authentication. CVE-2026-96652 is the tool that makes loopback reachable from an external position.
Comparison table: three chains
| Property | ProxyShell (2021) | SharePoint JWT (2026) | Plex2Shell (2026) |
|---|---|---|---|
| Auth bypass mechanism | SSRF + header manipulation | JWT validation fails open | SSRF + loopback trust |
| RCE mechanism | File write via cmdlet | Not direct RCE — API + lateral movement | File write via management API |
| Auth required | None | None | None |
| Internet-facing surface | Exchange (common) | SharePoint (common) | Plex (variable) |
| Chain length | 3 CVEs | 1 CVE (bypass) + escalation | 4 CVEs |
| Time to weaponisation | Weeks | Unknown — disclosed Oct 2026 | KEV-listed — already weaponised |
| KEV status | Yes (post-exploitation) | Monitor | Yes (Oct 20, 2026) |
How to write the chain report finding
What not to do:
> Finding 4.2.1: CVE-2021-34473 (CVSS 7.2) — Exchange SSRF > Finding 4.2.2: CVE-2021-34523 (CVSS 9.0) — Exchange auth bypass > Finding 4.2.3: CVE-2021-31207 (CVSS 7.5) — Exchange file write
These three findings read as separate medium/high items. A reader who skims the executive summary sees three Exchange findings, none of which individually screams "fix me today."
What to do:
> Finding 3.1: Unauthenticated Remote Code Execution via ProxyShell chain (CVE-2021-34473 + CVE-2021-34523 + CVE-2021-31207) — Critical > > An attacker on the internet can execute arbitrary code on the Exchange server without supplying valid credentials. The three-step chain uses path confusion (CVE-2021-34473) to access Exchange functions as SYSTEM, header manipulation (CVE-2021-34523) to bypass authentication requirements, and a file-write primitive (CVE-2021-31207) to install a webshell. No authentication is required at any step. > > Evidence: [HTTP request sequence demonstrating unauthenticated code execution; output of id or whoami command as SYSTEM context]
The compound finding leads with the combined impact. The individual CVEs appear in the technical detail section. The CVSS score computed for the combined path (unauthenticated RCE = Critical, CVSS 9.8) is the score that appears in the executive summary, not the individual scores.
Evidence standard for chain findings
For each step in the chain: 1. HTTP request/response or tool output demonstrating the step 2. Transition confirmation: evidence that step N enables step N+1 3. Terminal step: evidence of the final impact (shell output, data accessed, privilege level confirmed)
The chain is only as strong as the evidence connecting the steps. A finding that asserts "these CVEs chain to RCE" without demonstrating the linkage will be challenged in the debrief. Build the evidence set as you test the chain, not after.