CVE-2026-63520: Microsoft SharePoint Remote Code Execution Explained

Summary

A critical remote code execution vulnerability affects the Microsoft SharePoint Business Data Connectivity (BDC) subsystem. Attackers can abuse unrestricted .NET type instantiation within the DbTypeReflector class to execute arbitrary operating system commands. When combined with an authentication bypass, the flaw can enable unauthenticated RCE.

Investigation

The investigation identified an unrestricted .NET type instantiation primitive within the DbTypeReflector.ResolveDotNetType method. By uploading a malicious .bdcm model file, researchers demonstrated a gadget chain using System.Windows.Data.ObjectDataProvider to invoke Process.Start(). This enables arbitrary command execution with the privileges of the SharePoint service account.

Mitigation

The article does not specify exact patches or configuration changes, but it highlights the need for defenders to account for multiple gadget chains when building detection logic, including DotNetAssembly LOB systems and LosFormatter-based chains. Prompt patching of the affected SharePoint vulnerability is strongly implied.

Response

If exploitation is suspected, organizations should investigate unauthorized .bdcm file uploads and anomalous child processes spawned by w3wp.exe, the IIS worker process. Security teams should also monitor SharePoint BDC subsystem activity for suspicious .NET type instantiation patterns and unexpected command execution.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully exploited CVE-2026-63520 on a SharePoint server. To confirm code execution and establish a foothold, the attacker uses a gadget within the SharePoint service to invoke System.Diagnostics.Process.Start(). In this specific test case, the attacker invokes notepad.exe to verify the capability. The goal is to produce a Windows Event ID 4688 where the CallerProcess (the parent) contains the string SharePoint and the Image (the new process) is notepad.exe.

• Regression Test Script:

  # Simulation of a process spawned by a SharePoint service account
  # Note: We simulate the path structure to satisfy the 'contains' logic of the rule.
  
  $fakeSharePointPath = "C:Program FilesCommon Filesmicrosoft sharedWeb Server Extensions16ISAPISharePointService.exe"
  $targetProcess = "notepad.exe"
  
  Write-Host "[+] Simulating exploitation: Triggering $targetProcess via $fakeSharePointPath" -ForegroundColor Cyan
  
  # In a real environment, the OS handles the parent-child relationship.
  # For simulation purposes, we use a PowerShell block to represent the 'Caller' context 
  # if the detection engine relies on ParentProcessName/CallerProcess fields.
  
  # Since we cannot easily spoof a Kernel-level ParentProcessID without a driver, 
  # we simulate the telemetry generation by launching a process that mimics the intent.
  
  Start-Process -FilePath $targetProcess
  
  Write-Host "[+] Process spawned. Check SIEM for Event ID 4688 with CallerProcess containing 'SharePoint'" -ForegroundColor Green

• Cleanup Commands:

  # Close any instances of notepad opened during simulation
  Stop-Process -Name "notepad" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete: Notepad processes terminated." -ForegroundColor Yellow