CVE-2026-63520: RCE in Microsoft SharePoint via unsafe .NET type initialization

The vulnerability CVE-2026-63520 affects Microsoft SharePoint and allows an authenticated attacker to execute arbitrary code on the server with the privileges of the SharePoint service account. The issue is related to the Business Data Connectivity (BDC) subsystem, which lacks secure validation when resolving and instantiating .NET types from user-controlled BDC models. Specifically, the method Type.GetType() is called based on attacker-controlled data without validation, enabling the creation of arbitrary objects.

Exploitation is possible by uploading a malicious .bdcm file and building a gadget chain (for example, through ObjectDataProvider) followed by a call to Process.Start() to execute commands at the OS level. Combined with CVE-2026-55040 (authentication bypass), the attack can be extended, significantly increasing its severity and simplifying remote exploitation without credentials.

Article: https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520/