Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

1. Executive summary

Rapid7 has published a technical analysis of CVE-2026-63520, a HIGH severity (CVSS 8.1) remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC) subsystem (CWE-20: Improper Input Validation). The flaw allows an authenticated attacker to execute arbitrary code with the privileges of the SharePoint Site's service account by uploading a malicious .bdcm model file that triggers unsafe .NET type instantiation. When chained with the authentication bypass CVE-2026-55040 (disclosed separately in July 2026), the exploit chain achieves unauthenticated RCE against affected SharePoint servers. CVE-2026-63520 is NOT currently listed in CISA's KEV catalogue (EPSS 3%); however, EMEA financial services running on-premise SharePoint should treat this as a high-priority remediation target due to the potential for full system compromise via a well-understood gadget chain mechanism.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism

CVE-2026-63520 resides in the Microsoft SharePoint Business Data Connectivity (BDC) subsystem. The root cause is an unrestricted .NET type instantiation and property-setting primitive in the DbTypeReflector class, which resolves arbitrary assembly-qualified type names from BDC model XML without any allowlist or safety enforcement.

The vulnerable method is Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType(). When processing TypeDescriptor TypeName values from BDC model XML:

1. If the type name is fewer than 15 characters (e.g., System.Int32), the method falls through to the base class DotNetTypeReflector.ResolveDotNetType(), which has a limited type lookup path.
2. For any type name greater than 15 characters, the method calls Type.GetType(abstractTypeName, throwOnError: true) directly — resolving any assembly-qualified type name to its corresponding Type object with no restriction.

Combined with a recursive instantiation and property-setting mechanism in the parent DotNetTypeReflector.Instantiate() method, this allows an attacker to construct a gadget chain that triggers Process.Start() through the System.Windows.Data.ObjectDataProvider class's property-setter side-effect.

Confirmed attack chain

1. Initial access / authentication: The attacker requires authenticated access to the SharePoint server. When chained with CVE-2026-55040 (authentication bypass, disclosed July 2026), this prerequisite is removed, achieving unauthenticated RCE.
2. Model file upload: The attacker uploads a malicious .bdcm (BDC model) file containing a crafted TypeDescriptor element with a malicious TypeName attribute targeting System.Windows.Data.ObjectDataProvider (or other .NET types available in the Global Assembly Cache).
3. Type instantiation: The BDC subsystem processes the model XML. DbTypeReflector.ResolveDotNetType() calls Type.GetType() on the attacker-controlled TypeName value, resolving the arbitrary .NET type from the GAC.
4. Gadget chain execution: The DotNetTypeReflector.Instantiate() method recursively instantiates the type and sets arbitrary properties. The ObjectDataProvider property-setter side-effect triggers Process.Start(), achieving OS command execution.
5. Execution context: Code executes with the privileges of the SharePoint Site's service account.

Confirmed exploit variants

Two independent analyses have demonstrated exploitation via different LOB system types and gadget chains:

• Rapid7: Database Line-of-Business (LOB) system + ObjectDataProvider-based gadget chain.
• VulnCheck: DotNetAssembly LOB system + LosFormatter-based gadget chain.

Defenders should account for both variants. Rapid7 assesses it is highly likely other gadget chains may also be used.

Affected products

• All supported versions of Microsoft SharePoint Server (analysis based on SharePoint Server Subscription Edition version 16.0.19725.20210).
• Certain versions of Microsoft Project Server.
• Certain versions of Microsoft Office Web Apps Server.

Prior art

The technique of leveraging BDC models for unsafe .NET type instantiation was previously discussed in the ZDI writeup of CVE-2019-1257.

AI-assisted discovery context

Rapid7 developed this exploit chain using publicly available LLMs (Q1 2026-era models) guided by subject matter experts through agentic workflows. The research was originally an entry for Pwn2Own Berlin. Rapid7 notes that frontier model capabilities have significantly increased since Q1 2026, reducing the need for SME guidance. This is a single-sourced claim from Rapid7; the broader implication for defensive posture is that AI-accelerated vulnerability discovery against proprietary enterprise targets is operationally feasible.

Discrepancy note

The BSI advisory (WID-SEC-2026-1764) describes the attack as requiring a "remote, authenticated attacker," which is consistent with the VERIFIED REFERENCE DATA and Rapid7's analysis. The BleepingComputer and SecurityWeek related sources reference different CVEs (CVE-2026-45659 and CVE-2026-50522) and are not directly applicable to CVE-2026-63520; they are included as context on the broader SharePoint threat landscape.

4. Mitigation & containment

P1 — Within 24 hours

• Identify exposed assets: Inventory all on-premise Microsoft SharePoint Server, Microsoft Project Server, and Microsoft Office Web Apps Server installations. Prioritise internet-facing instances.
• Apply vendor patch: Microsoft released a patch for CVE-2026-63520 on August 11, 2026 (Patch Tuesday). Apply the latest cumulative update to all affected SharePoint Server instances immediately. For SharePoint Server Subscription Edition, update to a version newer than 16.0.19725.20210.
• Restrict BDC model upload: If patching cannot be completed immediately, restrict the ability to upload .bdcm model files to trusted administrators only. Monitor for any unauthorised .bdcm file uploads.

P2 — Within 72 hours

• Service account review: Review the privileges of the SharePoint Site service account. If exploitation has occurred, the attacker has code execution at this privilege level. Ensure the service account follows least-privilege principles and is not a local administrator on the SharePoint server.
• Hunt for exploitation: Search for unexpected .bdcm files in SharePoint content databases and filesystem. Look for child processes of the SharePoint application pool worker process (w3wp.exe) that indicate command execution (e.g., cmd.exe, powershell.exe, csc.exe).
• Network segmentation: Ensure SharePoint servers are segmented from domain controllers and other high-value assets. The service account context may permit lateral movement if the environment is flat.

P3 — Within 7 days

• Validate patch coverage: Confirm all SharePoint farm members, including Project Server and Office Web Apps components, are patched. Verify patch installation via SharePoint Central Administration or Get-SPProduct / Get-SPServer PowerShell cmdlets.
• Review BDC configuration: Audit existing BDC model definitions for any unexpected or unauthorised entries. Remove any models that cannot be attributed to legitimate business applications.
• Update EDR detections: Deploy detection rules (see §6) for the known gadget chain artefacts and process execution patterns.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material for CVE-2026-63520.

Behavioural indicators

6. Detection

rule Sharepoint_BDC_Malicious_Bdcm_Model {
  meta:
    author = "Adverse Trace"
    date = "2026-08-24"
    reference = "https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520"
    description = "Detects malicious BDC model XML files exploiting CVE-2026-63520 unsafe .NET type instantiation"

  strings:
    $bdcm_ext = ".bdcm" nocase
    $objectdataprovider = "System.Windows.Data.ObjectDataProvider" ascii
    $losformatter = "System.Web.UI.LosFormatter" ascii
    $process = "System.Diagnostics.Process" ascii
    $dbtypereflector = "DbTypeReflector" ascii
    $dotnettypereflector = "DotNetTypeReflector" ascii
    $typedescriptor = "TypeDescriptor" ascii
    $typename_attr = "TypeName" ascii

  condition:
    $bdcm_ext and $typename_attr and $typedescriptor and 1 of ($objectdataprovider, $losformatter, $process)
}

title: SharePoint w3wp.exe Spawning Command Shell or Process — Potential CVE-2026-63520 Exploitation
id: 7a3c1f2e-8b4d-4a6e-9c1f-2d5e8a7b3c6f
status: experimental
description: >
  Detects the SharePoint IIS worker process (w3wp.exe) spawning command interpreters
  or process-launching utilities, consistent with RCE via the ObjectDataProvider gadget
  chain exploiting CVE-2026-63520 in the BDC subsystem.
author: Adverse Trace
date: 2026/08/24
references:

  - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_suspicious_child:
    Image|endswith:

      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\csc.exe'
      - '\msbuild.exe'
  filter_sharepoint_apppool:
    ParentImage|contains:

      - 'sharepoint'
  condition: selection_parent and selection_suspicious_child
falsepositives:

  - Legitimate SharePoint administrative tasks or timer jobs invoking command-line tools (rare)
level: high

title: Suspicious BDC Model File Upload to SharePoint — CVE-2026-63520
id: 8b4d2e3f-9c5e-4b7f-ad2e-3e6f9b8c4d7a
status: experimental
description: >
  Detects creation or modification of .bdcm files containing references to dangerous
  .NET types used in CVE-2026-63520 exploit chains (ObjectDataProvider, LosFormatter,
  System.Diagnostics.Process).
author: Adverse Trace
date: 2026/08/24
references:

  - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
logsource:
  product: windows
  category: file_event
detection:
  selection_file:
    TargetFilename|endswith: '.bdcm'
  selection_malicious_content:
    TargetFilename|contains:

      - 'ObjectDataProvider'
      - 'LosFormatter'
      - 'System.Diagnostics.Process'
  condition: selection_file
falsepositives:

  - Legitimate BDC model development (rare in production environments)
level: high

CVE assessment

1 referenced CVE

7. Sources

• Rapid7 — Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) — https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520 — 2026-08-24
• Rapid7 — CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED) — https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed — 2026-08-11
• BSI Germany — [NEU] [hoch] Microsoft SharePoint: Schwachstelle ermöglicht Codeausführung — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1764 — date unspecified
• BleepingComputer — CISA: Microsoft SharePoint RCE flaw now actively exploited — https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited/ — (references a different CVE; context only)
• SecurityWeek — CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability — https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/ — (references CVE-2026-45659; context only)
• BleepingComputer — Critical SharePoint RCE flaw exploited to steal machine keys — https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/ — (references CVE-2026-50522; context only)
• Help Net Security — Another SharePoint RCE exploited: Patch, then rotate your machine keys — https://www.helpnetsecurity.com/2026/07/22/sharepoint-cve-2026-50522-exploited/ — (references CVE-2026-50522; context only)

8. Adverse Trace position

CVE-2026-63520 is a HIGH severity (CVSS 8.1, CWE-20) authenticated RCE vulnerability in Microsoft SharePoint's BDC subsystem, confirmed by Rapid7's technical analysis and independently corroborated by VulnCheck's alternative exploit variant. The vulnerability is NOT in CISA's KEV catalogue (EPSS 3%); however, the existence of at least two working gadget chains, the availability of prior art (CVE-2019-1257), and Rapid7's disclosure that a third party has already published details of the vulnerability increase the likelihood of PoC development and potential exploitation. The chaining with CVE-2026-55040 (authentication bypass) elevates the risk to critical for unpatched, internet-facing SharePoint deployments. EMEA financial services running on-premise SharePoint should patch immediately and hunt for signs of prior exploitation using the behavioural indicators and detection rules in §5 and §6. We will monitor for KEV addition, public PoC release, and any confirmed in-the-wild exploitation. The AI-assisted discovery methodology described by Rapid7 is a single-sourced claim but is operationally credible and reinforces the need for accelerated patch cycles on externally facing enterprise collaboration platforms.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.