RAPID 7's analysis of CVE-2026-63520 highlights a significant remote code execution (RCE) vulnerability in Microsoft SharePoint. This flaw, disclosed on August 11, 2026, allows an authenticated attacker to execute arbitrary code with the privileges of the SharePoint service account. The analysis describes the technical details of exploiting this vulnerability using unsafe .NET type instantiation in the Business Data Connectivity (BDC) subsystem.
It details methods used to bypass authentication and execute attacks, including a walkthrough showcasing HTTP requests necessary for triggering unsafe type instantiation. The findings emphasize the importance of understanding potential gadget chains and defensive measures.