--- title: Rapid7 and Microsoft disclose CVE-2026-63520, a new... description: Rapid7 Labs and Microsoft have disclosed CVE-2026-63520, a Remote Code Execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type... canonical: https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability | daily.dev og:description: Rapid7 Labs and Microsoft have disclosed CVE-2026-63520, a Remote Code Execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type... og:url: https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon og:image: https://api.daily.dev/og/posts/hfnwgFAON.png og:image:alt: Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 8 min read · 1 upvotes · 0 comments ## Summary Rapid7 Labs and Microsoft have disclosed CVE-2026-63520, a Remote Code Execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type instantiation in Business Connectivity Services. With a CVSSv3.1 score of 8.1 (High), it affects all supported SharePoint versions, Project Server, and Office Web Apps Server. When chained with the previously disclosed authentication bypass CVE-2026-55040, it enables unauthenticated RCE against vulnerable SharePoint servers. The exploit chain was developed using an AI-assisted agentic workflow guided by subject matter experts, accumulating 120 hours of agent runtime, 96 sessions, ~80,000 tool calls, and 256 prompts over 24 days. The research was originally entered into Pwn2Own Berlin. Patches are available; customers should apply the latest SharePoint updates immediately. Full technical details for the RCE will be published within 30 days of disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-63520 and how does it affect Microsoft SharePoint? CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type instantiation issue in Business Connectivity Services. It has a CVSSv3.1 score of 8.1 and lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It also affects certain versions of Project Server and Office Web Apps Server, and Microsoft has released patches customers should apply. _Teams tracking SharePoint patch status can follow security disclosures like this one on daily.dev._ ### How can CVE-2026-63520 be combined with CVE-2026-55040 to achieve unauthenticated RCE on SharePoint? CVE-2026-63520, an RCE flaw in Business Connectivity Services, can be chained with CVE-2026-55040, a JWT token authentication bypass disclosed a month earlier, to achieve unauthenticated remote code execution against a vulnerable SharePoint server. The RCE alone requires some access, but combined with the auth bypass an attacker needs no credentials at all, making the chain critical severity. _Security engineers assessing exploit chains can keep up with layered SharePoint vulnerabilities via daily.dev._ ### How did Rapid7 use AI models to discover the SharePoint RCE exploit chain? Rapid7 Labs used agentic AI workflows guided by a subject matter expert to discover and develop the SharePoint exploit chain between January and March, testing publicly available large language models. The effort involved 120 hours of agent run time over 24 days, 96 sessions, roughly 80,000 agentic tool calls, and 256 prompts, with the auth bypass found in early March and the RCE two weeks later. _Developers curious how AI agents accelerate vulnerability research can follow this work on daily.dev._ ## Similar posts on daily.dev - [CISA: Microsoft SharePoint RCE flaw now actively exploited](https://daily.dev/posts/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited-5qwo6lfyk) · BleepingComputer · 0 upvotes · 0 comments - [Hackers leverage new Microsoft SharePoint exploit in attacks](https://daily.dev/posts/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks-poikstdjk) · BleepingComputer · 0 upvotes · 0 comments - [Unknown attackers exploit another critical SharePoint bug](https://daily.dev/posts/unknown-attackers-exploit-another-critical-sharepoint-bug-wlvkhutcz) · The Register · 0 upvotes · 0 comments - [CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass \(FIXED\)](https://daily.dev/posts/cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed--qwfb7arbc) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#sharepoint](https://daily.dev/tags/sharepoint) [View this post on daily.dev](https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability","url":"https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon"},"datePublished":"2026-08-11T13:18:16.249Z","dateModified":"2026-09-14T08:35:56.281Z","description":"Rapid7 Labs and Microsoft have disclosed CVE-2026-63520, a Remote Code Execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,sharepoint","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-63520 and how does it affect Microsoft SharePoint?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type instantiation issue in Business Connectivity Services. It has a CVSSv3.1 score of 8.1 and lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It also affects certain versions of Project Server and Office Web Apps Server, and Microsoft has released patches customers should apply. Teams tracking SharePoint patch status can follow security disclosures like this one on daily.dev."}},{"@type":"Question","name":"How can CVE-2026-63520 be combined with CVE-2026-55040 to achieve unauthenticated RCE on SharePoint?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-63520, an RCE flaw in Business Connectivity Services, can be chained with CVE-2026-55040, a JWT token authentication bypass disclosed a month earlier, to achieve unauthenticated remote code execution against a vulnerable SharePoint server. The RCE alone requires some access, but combined with the auth bypass an attacker needs no credentials at all, making the chain critical severity. Security engineers assessing exploit chains can keep up with layered SharePoint vulnerabilities via daily.dev."}},{"@type":"Question","name":"How did Rapid7 use AI models to discover the SharePoint RCE exploit chain?","acceptedAnswer":{"@type":"Answer","text":"Rapid7 Labs used agentic AI workflows guided by a subject matter expert to discover and develop the SharePoint exploit chain between January and March, testing publicly available large language models. The effort involved 120 hours of agent run time over 24 days, 96 sessions, roughly 80,000 agentic tool calls, and 256 prompts, with the auth bypass found in early March and the RCE two weeks later. Developers curious how AI agents accelerate vulnerability research can follow this work on daily.dev."}}]} ```