SharePoint Unauthenticated RCE: The Business Connectivity Services Trap
A new SharePoint exploit chain pairs CVE-2026-63520 with an auth bypass for unauthenticated RCE. Patch your on-prem servers immediately.
4 min. read
If you still manage on-premises SharePoint servers for your clients, it is time to drop what you are doing and check your patch management queue. Security researchers at Rapid7 Labs just detailed a critical flaw tracked as CVE-2026-63520. When paired with an earlier vulnerability disclosed last month, this bug completes a two-part exploit chain that hands unauthenticated attackers full remote code execution on vulnerable machines.
The root cause comes down to an unsafe .NET type instantiation flaw inside SharePoint's Business Connectivity Services. BCS is the underlying component responsible for letting SharePoint talk to external databases and web services. When untrusted data hits this framework, the application fails to validate the input properly, allowing an attacker to force SharePoint into instantiating arbitrary types. That code then executes with the full privileges of the SharePoint site service account.
What makes this particularly dangerous is the sheer amount of access an attacker gets once they land on the system. They bypass authentication completely thanks to the first half of the chain, CVE-2026-55040. From there, they can drop payloads, exfiltrate private document repositories, or use the compromised server as a pivot point to move laterally across the corporate network.
While Microsoft lists the attack complexity as high due to the technical requirements needed to chain both exploits together, they still marked the issue as "exploitation more likely." No public proof-of-concept code has leaked into the wild yet, but weaponization usually follows fast once advisory details hit the public.
The flaw affects all currently supported versions of SharePoint Server, as well as specific builds of Microsoft Project Server and Office Web Apps Server. Fixing this requires applying every KB update package associated with your specific server build. If you run SharePoint 2016 or 2019, pay close attention to the patch prerequisites, as missing an intermediate package will leave the vulnerability exposed.
If you have SharePoint instances sitting on the perimeter or hanging out in loosely segmented DMZs, audit them immediately. Apply the latest Microsoft updates, review your service account permissions, and restrict access to Business Connectivity Services where possible.
If you want to see more helpful everyday guides, scripts, and technical deep dives just like this, make sure to follow us on Twitter, check out our Facebook and Youtube pages, and sign up for the weekly 404 & More newsletter! ✌️
