Rapid7 published a technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC) subsystem. The root cause is an unrestricted .NET type instantiation in the DbTypeReflector class, which calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without any allowlist validation. An authenticated attacker can upload a malicious .bdcm BDC model file and trigger entity execution to instantiate arbitrary .NET types from the GAC, leveraging an ObjectDataProvider gadget chain to achieve OS command execution via Process.Start(). When chained with the authentication bypass CVE-2026-55040, the result is unauthenticated RCE. The post includes full HTTP request walkthroughs, the malicious BDC model XML, pseudocode for the gadget chain, and a debugger call stack trace confirming exploitation. Defenders are warned that multiple gadget chains are viable, as a separate VulnCheck analysis used a DotNetAssembly LOB system with a LosFormatter-based chain instead.
Questions this post answers
How does CVE-2026-63520 achieve remote code execution on Microsoft SharePoint?
CVE-2026-63520 exploits the DbTypeReflector.ResolveDotNetType() method in SharePoint's Business Data Connectivity subsystem, which calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without any allowlist. An attacker uploads a malicious .bdcm BDC model file defining an ObjectDataProvider gadget chain that sets ObjectInstance to a Process instance, triggering Process.Start() and executing arbitrary OS commands with the SharePoint service account's privileges. Security teams defending SharePoint deployments track exploit chains like this on daily.dev as they emerge.
What is the exploit chain when combining CVE-2026-63520 and CVE-2026-55040 in SharePoint?
Combining CVE-2026-63520 with the JWT authentication bypass CVE-2026-55040 produces unauthenticated RCE against a vulnerable SharePoint server. CVE-2026-55040 provides a forged Bearer token and X-RequestDigest, removing the authentication requirement for uploading the malicious BDC model and triggering the ObjectDataProvider gadget chain that calls Process.Start(). Defenders patching SharePoint against chained exploits like these stay current on daily.dev.
What SharePoint API endpoints are used to exploit CVE-2026-63520?
Exploitation requires three HTTP POST requests: first to /_api/web/folders to create a BusinessDataMetadataCatalog folder, then to /_api/web/GetFolderByServerRelativeUrl to upload the malicious BDCMetadata.bdcm model file, and finally to /_vti_bin/client.svc/ProcessQuery calling FindSpecificDefault to trigger the gadget chain and achieve code execution. Penetration testers and blue teams working SharePoint vulnerabilities find detailed writeups like this on daily.dev.