CVE-2026-63520: SharePoint RCE Chain Probed in the Wild, PoC Public

Security researchers have released full technical details and proof-of-concept exploit code for a critical SharePoint RCE vulnerability tracked as CVE-2026-63520. Threat actors are already probing this flaw alongside an authentication bypass in the wild. Consequently, organizations running on-premises SharePoint servers must install Microsoft security updates immediately to protect their systems.

Why This Vulnerability Matters

This vulnerability presents an immediate threat to enterprise environments. When attackers combine this flaw with authentication bypass CVE-2026-55040, they achieve unauthenticated remote code execution. Furthermore, threat monitoring teams have already spotted active exploitation attempts in live environments.

Security firm Defused reported on X that threat actors are actively scanning for vulnerable instances. The researchers confirmed, “We’re seeing the SharePoint CVE-2026-55040 + CVE-2026-63520 RCE chain probed in our honeypots.” Industry estimates indicate that tens of thousands of SharePoint servers remain exposed to the public internet. Therefore, unpatched systems face immediate risk of remote takeover.

How the Attack Works

The root cause lies inside the Microsoft SharePoint Business Data Connectivity subsystem. Specifically, the component fails to restrict .NET type instantiation when parsing model files.

Unrestricted Type Resolution

The flaw occurs within the DbTypeReflector class. According to the analysis, “The vulnerability exists in the Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType() method, which directly calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without validation.”

When a type name exceeds 14 characters, the method calls Type.GetType() directly. Because the code lacks an allowlist, it resolves any type located in the Global Assembly Cache. As a result, an attacker can define arbitrary .NET objects inside a malicious metadata file.

Executing the Gadget Chain

Next, the attacker uploads a crafted model file to the SharePoint server. The attacker triggers execution using the ObjectDataProvider class. By setting specific object properties, the attacker forces the server to launch external processes.

Meanwhile, other security researchers discovered alternative exploitation paths. For instance, researchers can trigger execution by using a DotNetAssembly system paired with a LosFormatter gadget chain. These diverse attack chains allow adversaries to run commands under the privileges of the SharePoint service account.

Affected Versions

This critical SharePoint RCE vulnerability affects multiple supported editions of Microsoft SharePoint. Impacted products include SharePoint Server Subscription Edition version 16.0.19725.20210 and earlier builds. In addition, older supported SharePoint Server releases also contain the vulnerable subsystem.

Patch and Mitigation Steps

Microsoft addressed this flaw in its August 11, 2026 security release. System administrators must apply the latest official SharePoint updates immediately across all server farms. You can read the complete technical analysis in the Rapid7 vulnerability report.

Additionally, defenders should monitor their network logs for suspicious requests hitting the metadata catalog endpoints. You can review the threat intelligence findings on the Defused honeypot alert on X. Restricting administrative endpoint access to internal networks provides extra protection until all patches are deployed.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.