Skip to main content
IMMUNITYSEC
Vulnerabilities

Microsoft SharePoint BDC RCE (CVE-2026-63520): Authenticated .NET Gadget Chain with Unauthenticated Chain via CVE-2026-55040

2026-08-12•Updated 2026-08-24•5 min read

A remote code execution flaw in the Microsoft SharePoint Business Data Connectivity subsystem allows an authenticated attacker to instantiate arbitrary .NET types from BDC model XML and trigger OS command execution. Chained with the CVE-2026-55040 authentication bypass, the result is unauthenticated RCE with the SharePoint site service account's privileges.

Core Technical Takeaways

  • >CVE-2026-63520 stems from an unrestricted .NET type instantiation and property-setting primitive in the DbTypeReflector class, which resolves arbitrary assembly-qualified type names from BDC model XML without any allowlist.
  • >An attacker who can upload a malicious .bdcm model file and trigger entity execution can instantiate any .NET type in the Global Assembly Cache, set arbitrary properties, and use property-setter side effects to achieve OS command execution.
  • >On its own the flaw is authenticated RCE; chained with the CVE-2026-55040 authentication bypass it becomes unauthenticated RCE running as the SharePoint site service account.
  • >Multiple gadget chains are viable. Rapid7 demonstrated a Database LOB system with an ObjectDataProvider gadget, while VulnCheck used a DotNetAssembly LOB system with a LosFormatter gadget, so defenders must account for more than one exploitation pattern.

Overview of CVE-2026-63520

On August 11, 2026, Rapid7 and Microsoft disclosed CVE-2026-63520, a remote code execution vulnerability affecting Microsoft SharePoint. A remote authenticated attacker can execute arbitrary code on a vulnerable SharePoint server with the privileges of the SharePoint site's service account. When combined with the authentication bypass CVE-2026-55040, the resulting exploit chain is unauthenticated RCE. Rapid7 published its technical analysis on August 24, 2026, expediting a planned 30-day timeline because a third party had already published details.

Attribute Specification
CVE Identifier CVE-2026-63520
Related CVE CVE-2026-55040 (authentication bypass, enables unauth chain)
Affected product Microsoft SharePoint Server (analysis on Subscription Edition 16.0.19725.20210)
Attack vector Network; authenticated RCE, or unauthenticated when chained
Execution context SharePoint site service account
Vulnerable subsystem Business Data Connectivity (BDC)

Root cause: unrestricted .NET type instantiation in DbTypeReflector

The vulnerability exists in the SharePoint Business Data Connectivity (BDC) subsystem. The root cause is an unrestricted .NET type instantiation and property-setting primitive in the DbTypeReflector class, which resolves arbitrary assembly-qualified type names from BDC model XML without any allowlist or safety enforcement. An attacker who can upload a malicious .bdcm model file and trigger entity execution can instantiate any .NET type in the Global Assembly Cache (GAC), set arbitrary properties, and use property-setter side effects to achieve OS command execution.

Multiple viable gadget chains

More than one gadget chain achieves execution, a notable defensive concern:

Analysis LOB System Gadget Chain
Rapid7 Database Line-of-Business system ObjectDataProvider based gadget chain
VulnCheck DotNetAssembly Line-of-Business system LosFormatter based gadget chain

Rapid7 warns that other gadget chains may also be viable; signature-based detections keying on a single LOB system or gadget type will miss alternative exploitation patterns.

The authentication-bypass chain

CVE-2026-63520 on its own requires authentication, which limits exposure. The severity escalates when chained with CVE-2026-55040, an authentication bypass that converts authenticated RCE into unauthenticated RCE: an external attacker with no credentials can reach code execution on an internet-exposed SharePoint server. Perimeter exposure of SharePoint is the single most important risk variable.

Remediation

  1. 1.
    Apply Microsoft's security update for SharePoint Server immediately, prioritizing internet-exposed instances where the CVE-2026-55040 + CVE-2026-63520 unauthenticated chain applies.
  2. 2.
    Restrict SharePoint exposure at the network perimeter; remove public internet reachability for admin and BDC endpoints.
  3. 3.
    Audit .bdcm model uploads and restrict BDC model publishing to trusted administrators.
  4. 4.
    Build detections for both known gadget chains (ObjectDataProvider via Database LOB and LosFormatter via DotNetAssembly LOB).
# Identify SharePoint Server build version
Get-SPProduct | Format-List Name, Version

# Review BDC model catalog for unexpected entries
Get-SPBusinessDataCatalogMetadataObject -BdcObjectType Model -ServiceContext http://localhost

# Audit IIS bindings for internet-exposed SharePoint web apps
Get-SPWebApplication | Select-Object Name, Url