Rapid7 has published a full technical breakdown of the Microsoft SharePoint code execution bug it disclosed two weeks ago, weeks earlier than it meant to, because another research team put competing exploit details online first. The writeup is a working recipe for turning an ordinary SharePoint integration feature into a way to run Windows commands on the server.
That matters more than a scheduling change usually would. There are now two published exploits for the same flaw, and they do not look alike.
Two routes to the same takeover
Both exploits reach code execution through SharePoint's Business Data Connectivity subsystem, which lets administrators wire SharePoint up to external data sources using an XML model file. Rapid7 got there using a Database line of business system and an ObjectDataProvider gadget chain. The other published analysis, which Rapid7 attributes to VulnCheck, used a DotNetAssembly line of business system and a LosFormatter chain. Rapid7 says defenders should account for that difference when detecting the flaw, and that it is highly likely other gadget chains may also be used. A rule written around the artifacts of one exploit will not necessarily catch the other.
A feature that instantiates anything you name
The flaw itself, CVE-2026-63520, sits in a class called DbTypeReflector, which resolves .NET type names out of the model file. Rapid7 shows that any type name longer than 14 characters is handed straight to Type.GetType() with no allowlist and no safety enforcement, so an attacker who can upload a model file and trigger it can instantiate almost any .NET type available on the server and set properties on it. Setting one particular property is what starts a process. Researcher Stephen Fewer, who wrote the analysis, credits earlier Zero Day Initiative work on CVE-2019-1257 in the same subsystem as useful prior art. The testing was done against SharePoint Server Subscription Edition build 16.0.19725.20210.
The front door is already being kicked in
On its own, CVE-2026-63520 needs an attacker who is already authenticated, which is why it carries a CVSS score of 8.1 rather than a critical rating. Chained with CVE-2026-55040, the SharePoint authentication bypass Rapid7 disclosed in July, the result is unauthenticated remote code execution. CISA added that bypass to its Known Exploited Vulnerabilities catalog on August 18, and IntelFusions covered the attacks that put it there. The half of the chain that gets an intruder through the door is in active use, and the half that hands them the server is now documented in public twice.
Patch, then go hunting
Microsoft shipped fixes for both bugs at disclosure, and IntelFusions covered the chain when the second half landed. Patching is the fix, and the report offers no workaround. For anyone who has been slow, the walkthrough doubles as a hunting guide: the exploit begins by creating a BusinessDataMetadataCatalog folder through a POST to the /_api/web/folders endpoint, then uploads the malicious model file, and ends with a child process spawned by the w3wp.exe IIS worker process. Those three artifacts, in that order, are worth an alert.
Expedited timelines are becoming the norm once a second team goes public, and the practical effect for defenders is that the gap between a patch and a usable public exploit keeps shrinking. Read Rapid7's full analysis before writing detections for this one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.