--- title: Technical Analysis of Microsoft SharePoint Remote Code... description: Rapid7 published a technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC)... canonical: https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520 | daily.dev og:description: Rapid7 published a technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC)... og:url: https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4 og:image: https://api.daily.dev/og/posts/5LEsi7Ws4.png og:image:alt: Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520 **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 11 min read · 0 upvotes · 0 comments ## Summary Rapid7 published a technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC) subsystem. The root cause is an unrestricted .NET type instantiation in the DbTypeReflector class, which calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without any allowlist validation. An authenticated attacker can upload a malicious .bdcm BDC model file and trigger entity execution to instantiate arbitrary .NET types from the GAC, leveraging an ObjectDataProvider gadget chain to achieve OS command execution via Process.Start(). When chained with the authentication bypass CVE-2026-55040, the result is unauthenticated RCE. The post includes full HTTP request walkthroughs, the malicious BDC model XML, pseudocode for the gadget chain, and a debugger call stack trace confirming exploitation. Defenders are warned that multiple gadget chains are viable, as a separate VulnCheck analysis used a DotNetAssembly LOB system with a LosFormatter-based chain instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does CVE-2026-63520 achieve remote code execution on Microsoft SharePoint? CVE-2026-63520 exploits the DbTypeReflector.ResolveDotNetType() method in SharePoint's Business Data Connectivity subsystem, which calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without any allowlist. An attacker uploads a malicious .bdcm BDC model file defining an ObjectDataProvider gadget chain that sets ObjectInstance to a Process instance, triggering Process.Start() and executing arbitrary OS commands with the SharePoint service account's privileges. _Security teams defending SharePoint deployments track exploit chains like this on daily.dev as they emerge._ ### What is the exploit chain when combining CVE-2026-63520 and CVE-2026-55040 in SharePoint? Combining CVE-2026-63520 with the JWT authentication bypass CVE-2026-55040 produces unauthenticated RCE against a vulnerable SharePoint server. CVE-2026-55040 provides a forged Bearer token and X-RequestDigest, removing the authentication requirement for uploading the malicious BDC model and triggering the ObjectDataProvider gadget chain that calls Process.Start(). _Defenders patching SharePoint against chained exploits like these stay current on daily.dev._ ### What SharePoint API endpoints are used to exploit CVE-2026-63520? Exploitation requires three HTTP POST requests: first to /_api/web/folders to create a BusinessDataMetadataCatalog folder, then to /_api/web/GetFolderByServerRelativeUrl to upload the malicious BDCMetadata.bdcm model file, and finally to /_vti_bin/client.svc/ProcessQuery calling FindSpecificDefault to trigger the gadget chain and achieve code execution. _Penetration testers and blue teams working SharePoint vulnerabilities find detailed writeups like this on daily.dev._ ## Similar posts on daily.dev - [Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability](https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon) · Rapid7 Cybersecurity Blog · 1 upvotes · 0 comments - [Critical SharePoint RCE flaw exploited to steal machine keys](https://daily.dev/posts/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys-6nkweos4o) · BleepingComputer · 0 upvotes · 0 comments - [Unknown attackers exploit another critical SharePoint bug](https://daily.dev/posts/unknown-attackers-exploit-another-critical-sharepoint-bug-wlvkhutcz) · The Register · 0 upvotes · 0 comments - [Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability](https://daily.dev/posts/exploitation-of-knowledgedeliver-via-viewstate-deserialization-vulnerability-cdxn7gdbl) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520","url":"https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4"},"datePublished":"2026-08-24T17:20:41.502Z","dateModified":"2026-08-26T15:07:43.662Z","description":"Rapid7 published a technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/technical-analysis-of-microsoft-sharepoint-remote-code-execution-vulnerability-cve-2026-63520-5lesi7ws4#faq","mainEntity":[{"@type":"Question","name":"How does CVE-2026-63520 achieve remote code execution on Microsoft SharePoint?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-63520 exploits the DbTypeReflector.ResolveDotNetType() method in SharePoint's Business Data Connectivity subsystem, which calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without any allowlist. An attacker uploads a malicious .bdcm BDC model file defining an ObjectDataProvider gadget chain that sets ObjectInstance to a Process instance, triggering Process.Start() and executing arbitrary OS commands with the SharePoint service account's privileges. Security teams defending SharePoint deployments track exploit chains like this on daily.dev as they emerge."}},{"@type":"Question","name":"What is the exploit chain when combining CVE-2026-63520 and CVE-2026-55040 in SharePoint?","acceptedAnswer":{"@type":"Answer","text":"Combining CVE-2026-63520 with the JWT authentication bypass CVE-2026-55040 produces unauthenticated RCE against a vulnerable SharePoint server. CVE-2026-55040 provides a forged Bearer token and X-RequestDigest, removing the authentication requirement for uploading the malicious BDC model and triggering the ObjectDataProvider gadget chain that calls Process.Start(). Defenders patching SharePoint against chained exploits like these stay current on daily.dev."}},{"@type":"Question","name":"What SharePoint API endpoints are used to exploit CVE-2026-63520?","acceptedAnswer":{"@type":"Answer","text":"Exploitation requires three HTTP POST requests: first to /_api/web/folders to create a BusinessDataMetadataCatalog folder, then to /_api/web/GetFolderByServerRelativeUrl to upload the malicious BDCMetadata.bdcm model file, and finally to /_vti_bin/client.svc/ProcessQuery calling FindSpecificDefault to trigger the gadget chain and achieve code execution. Penetration testers and blue teams working SharePoint vulnerabilities find detailed writeups like this on daily.dev."}}]} ```