Skip to content

Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE chain (VulnCheck, Aug 24)

Summary

On August 24, 2026, VulnCheck's Initial Access Intelligence team published a complete analysis of an unauthenticated remote-code-execution chain against Microsoft SharePoint Server that combines two recently disclosed flaws discovered by Rapid7's Stephen Fewer:

  • CVE-2026-55040 — JWT token authentication bypass (weak authentication, CWE-1390; added to CISA KEV August 18, 2026, BOD 26-04 due 2026-08-21);
  • CVE-2026-63520 — unsafe .NET type instantiation in Business Connectivity Services (fixed in August 2026 cumulative update KB5002893).

Used together, a remote attacker with no credentials can forge a JWT, harvest a FormDigestValue from a privileged endpoint, submit a malicious BDC model (BDCM) to the Business Data Catalog, and trigger Activator.CreateInstance on an attacker-chosen .NET type — unauthenticated RCE on the SharePoint server. Rapid7 published a PoC for CVE-2026-55040 on August 11, 2026; honeypot providers immediately reported in-the-wild exploitation, VulnCheck KEV listed it on August 12, and CISA KEV on August 18. VulnCheck Target Intelligence counts at least 8,500 SharePoint servers on the open internet after deduplicating honeypots. The exploit, a version scanner, Suricata/Snort rules, PCAPs, and ASM queries are available to VulnCheck Initial Access Intelligence customers.

Tags

The chain

VulnCheck's dissection shows the full path from unauthenticated attacker to code execution:

  1. CVE-2026-55040 (auth bypass): improper validation in SharePoint's JWT handling (SPJsonWebSecurityTokenHandlerV2) lets an unauthenticated attacker forge a JWT for a privileged SharePoint user — the trusted identity's SID or user principal name must be known/configured. With that forged token the attacker retrieves a FormDigestValue from a privileged endpoint.
  2. Privileged access: the forged JWT plus the form digest grants authenticated access in "useful" ways, including modifying the application through Business Connectivity Services (BCS) / the Business Data Catalog (BDC) layer.
  3. CVE-2026-63520 (the RCE sink): unsafe .NET type instantiation in BCS. The August 2026 cumulative update (KB5002893) adds ValidateSafeBcsType in Microsoft.SharePoint/Microsoft/SharePoint/BusinessData/Infrastructure/DotNetTypeReflector.cs: only types in the farm's BCSAllowedTypeNames allow list may be used by BCS models; everything else is blocked. The function is called in at least 16 locations in the patched image.
  4. Exploitation vehicle: a BDC model (BDCM) uploaded to BusinessDataMetadataCatalog whose LobSystem Type="DotNetAssembly" defines an entity with a Class property set to an assembly-qualified type and a Deserialize Method whose Finder MethodInstance calls it. The most direct "resolve, then create" sink VulnCheck identified is GetEntityObject in DotNetAssemblyConnectionManager.cs: it reads the entity's Class property, resolves the type, and runs Activator.CreateInstance on it.
  5. The payload: the BDCM's input parameter carries a LosFormatter / TypeConfuseDelegate gadget as a DefaultValue (base64 .NET object-graph blob in the metadata XML). Querying the external list created by the model (GET /_api/web/lists/getbytitle('<list>')/items) invokes the Finder → Deserialize → RCE. The public PoC launches calc.exe; the base64 payload decodes to a System.Web.UI.LosFormatter-deserialized TypeConfuseDelegate.

The three observable HTTP stages are: POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url='...bdcm',overwrite=true) (upload BDCM, with forged Authorization: Bearer + X-Requestdigest), then a request creating the external list wired to the model, then the GET that detonates it.

Timeline

  • August 11, 2026 — Rapid7 (Stephen Fewer) publishes CVE-2026-55040 write-up and PoC; Microsoft ships the August 2026 SharePoint cumulative update (KB5002893) fixing both CVEs.
  • August 12, 2026 — honeypot providers report in-the-wild exploitation; VulnCheck adds the flaw to its KEV.
  • August 18, 2026 — CISA adds CVE-2026-55040 to KEV (weak authentication, CWE-1390; BOD 26-04 due 2026-08-21; ransomware use recorded as unknown; no actor named).
  • August 24, 2026 — VulnCheck publishes the full RCE-chain analysis (CVE-2026-55040 + CVE-2026-63520), exploit, scanner, IDS rules, and PCAPs.

Why the chain matters

CVE-2026-55040 alone is a "prove some impact" auth bypass; it is not enough to demonstrate the criticality of the flaw or build complete protections. The 63520 RCE prong is what turns it into a weapon: the same BDC upload pattern was used in CVE-2023-24955 (code-injection RCE, 2023) and CVE-2019-1257 (code-injection-to-BDC deserialization, 2019) — BDC metadata models have been a recurring SharePoint exploitation sink, and this chain is a modern, unauthenticated variant reaching it through a forged JWT rather than an authenticated session.

Defender priorities

  1. Apply the August 2026 SharePoint cumulative update (KB5002893) to every farm component and front-end proxy. The ValidateSafeBcsType / BCSAllowedTypeNames allow-list fix and the JWT validation fix are in the same update; partial patching (JWT only, or BCS only) leaves either half of the chain live.
  2. Inventory internet-facing SharePoint. At least 8,500 SharePoint servers were visible on the open internet in VulnCheck's Target Intelligence sweep; ASM counts vary wildly. If your SharePoint is reachable without a VPN or IP allow-list, assume it has been scanned by the public PoC and the customer exploit.
  3. Hunt for BDCM uploads and external-list creation. Look for new files in BusinessDataMetadataCatalog (any *.bdcm written out of band), external-list creation requests (/_api/web/lists/getbytitle against freshly created lists with LobSystemInstance/MetadataCatalogFileName properties), and DotNetAssembly-typed LobSystems — none of these are normal in most farms.
  4. Watch for LosFormatter deserialization and unexpected child processes of the SharePoint application pool (w3wp.exe spawning cmd.exe/powershell.exe/calc.exe from the IIS worker) — the PoC detonation shape is a deserialization-driven Activator.CreateInstance on System.Web.UI.LosFormatter followed by process spawn.
  5. Correlate the auth-bypass half separately. Forged-JWT traffic to privileged endpoints (requests carrying Authorization: Bearer JWTs with X-Requestdigest digests from the same source, unusual SPJsonWebSecurityTokenHandlerV2 behavior, access as privileged accounts without corresponding logons) can occur before or without the full RCE chain.
  6. Patch the surrounding KEV context too. This is one of several active SharePoint exploitation stories on this wiki (see related pages below); the August 18 KEV addition and the now-public unauthenticated RCE chain make SharePoint farms a top-tier patch-now target.
  7. Preserve evidence before destructive cleanup — application, access, and IIS logs while the farm is still usable; CISA's BOD 26-04 forensics-triage requirement applies to federal systems.

Indicators

  • File: new *.bdcm files in the SharePoint BusinessDataMetadataCatalog directory; external-list XML with LobSystem Type="DotNetAssembly" and Method Name="Deserialize".
  • Request: POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url=...bdcm,overwrite=true) with a forged Bearer JWT and X-Requestdigest.
  • Payload: base64 .NET object-graph (LosFormatter / TypeConfuseDelegate) embedded in BDCM DefaultValue XML.
  • Process: w3wp.exe → cmd.exe / powershell.exe / arbitrary child process from the SharePoint app pool.
  • Version boundary: SharePoint Server builds before the August 2026 cumulative update (KB5002893) are exploitable; ValidateSafeBcsType is present in patched DotNetTypeReflector.cs.

Sources