RAPID7 CYBERSECURITY BLOG
CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)
KEV HIGH SharePoint RCE zero-day Pwn2Own
Strategic summary
Rapid7 Labs discovered CVE-2026-63520 during zero-day research on Microsoft SharePoint; it affects all supported versions. The vulnerability enables remote code execution with SharePoint Site service account privileges due to an unsafe .NET type instantiation in Business Connectivity Services. Combined with CVE-2026-55040, a JWT token authentication bypass, it forms a critical unauthenticated RCE chain. Microsoft has fixed the vulnerability; its CVSSv3.1 score is 8.1 (High) with CWE-20.
Key findings
- CVE-2026-63520 affects all supported Microsoft SharePoint versions and allows remote code execution with SharePoint Site service account privileges.
- The root cause is an unsafe .NET type instantiation in Business Connectivity Services (CWE-20: Improper Input Validation).
- Combined with CVE-2026-55040, a JWT token authentication bypass, it forms a critical unauthenticated RCE chain.
- CVSSv3.1 score: 8.1 (High); Microsoft has fixed the vulnerability.
- CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog on August 18, 2026 due to active exploitation.
Relevance for you
Unsafe .NET type instantiation in Business Connectivity Services enables remote code execution with SharePoint service account privileges; developed as a Pwn2Own entry and affects all supported SharePoint versions.
Mentioned CVEs
Risk score
70
- cvss base
- 81.00
- kev bonus
- 20.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 116.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 28.00
- vendor mismatch penalty
- 0.00
Path: operational