A remote code execution (RCE) vulnerability, identified as CVE-2026-63520, has been disclosed in Microsoft SharePoint, allowing an authenticated attacker to execute arbitrary code on a vulnerable server. When chained with an authentication bypass vulnerability, CVE-2026-55040, the exploit becomes unauthenticated.
The vulnerability resides within the Business Data Connectivity (BDC) subsystem of Microsoft SharePoint, specifically due to unrestricted .NET type instantiation and property-setting capabilities within the `DbTypeReflector` class. This class resolves arbitrary assembly-qualified type names from BDC model XML without proper allowlisting or safety enforcement.
An attacker can exploit this by uploading a specially crafted `.bdcm` model file and triggering entity execution. This allows them to instantiate any .NET type available in the Global Assembly Cache (GAC), set arbitrary properties on these instances, and leverage property-setter side-effects to achieve operating system command execution.
Technical analysis, based on SharePoint Server Subscription Edition version 16.0.19725.20210, points to the `Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType()` method as the source of the flaw. This method directly calls `Type.GetType()` on attacker-controlled `TypeName` values from `TypeDescriptor` elements in BDC model XML without validation.
For type names exceeding 15 characters, the `ResolveDotNetType()` method directly invokes `Type.GetType(abstractTypeName, throwOnError: true)`. This allows the resolution of any assembly-qualified type name to its corresponding `Type` object, bypassing restrictions on permitted assemblies or types.
Researchers demonstrated an exploit leveraging a Database Line-of-Business (LOB) system and an `ObjectDataProvider`-based gadget chain to trigger `Process.Start()` through property-setter side-effects. Another analysis of the same vulnerability utilized a `DotNetAssembly` LOB system and a `LosFormatter`-based gadget chain, indicating that multiple gadget chains may be viable for exploitation.
The technique of leveraging BDC models for unsafe .NET type instantiation has historical precedent, with prior research on CVE-2019-1257 by the ZDI team discussing similar concepts. Defenders are advised to consider the potential for various gadget chains when implementing detection mechanisms for CVE-2026-63520.
