Improper input validation in Microsoft Office SharePoint

CVE-2026-63520 is an unsafe .NET type instantiation flaw in SharePoint Server's Business Connectivity Services (BCS). By itself, this bug requires an authenticated session to trigger — but when chained with CVE-2026-55040, a JWT authentication bypass patched in July 2026, an unauthenticated attacker can forge a valid token, impersonate a site admin, and then invoke the BCS gadget chain to achieve remote code execution as the SharePoint farm service account. All supported on-premises versions are affected: SharePoint Server 2016 (≤ 16.0.5565.1001), SharePoint Server 2019 (≤ 16.0.10417.20198), and SharePoint Server Subscription Edition (≤ 16.0.19725.20522). Microsoft Project Server and Office Web Apps Server are also affected.

Microsoft rates this CVE individually as HIGH / 8.1 with AC:H — and that's *roughly fair* if you evaluate the bug in isolation. The complication is the chain: combined with the July auth-bypass, the effective impact is unauthenticated RCE at farm-service-account privilege. However, the attack complexity is genuinely high (the .NET gadget chain is non-trivial to weaponize), and the first link in the chain (CVE-2026-55040) was patched a full month ago. Organizations that applied July Patch Tuesday are already immune to the full chain. For the subset that didn't — and Shadowserver counts ~10,000 internet-exposed SharePoint servers, many historically slow to patch — the risk is severe. We keep the severity at HIGH but nudge the score to 7.5 to reflect the dependency on a month-old unpatched prerequisite and the AC:H friction.

Why this verdict

• Chain dependency narrows population: The full unauthenticated RCE chain requires CVE-2026-55040 to be unpatched. That bug was fixed in July 2026 — one full patch cycle ago. Organizations with ≤30-day SLAs have already closed this door, eliminating the chain for a significant fraction of the installed base.
• AC:H is genuine friction: Microsoft's own CVSS rates attack complexity as High. The .NET BCS gadget chain requires specific type instantiation sequences. No public PoC exists, and Rapid7's 30-day embargo pushes weaponization to mid-September at earliest. This is not a spray-and-pray vulnerability.
• Limited internet exposure: On-premises SharePoint is a shrinking footprint. Censys counts ~1,500 distinct hosts; Shadowserver tracks ~10,000 including virtual hosts. Most enterprise SharePoint has migrated to SharePoint Online (not affected). The reachable attack surface is small relative to the total SharePoint installed base.
• Role multiplier — SharePoint farm account is a domain-compromise pivot: The farm service account typically holds dbcreator and securityadmin SQL roles and is a domain account. Resecurity's Operation FarmKey demonstrated the full path from SharePoint WFE → SQL → AD → domain controller. This blast radius is domain-scale, which sets the severity floor at HIGH and prevents downgrade to MEDIUM despite the friction factors.
• No exploitation, no KEV, low EPSS: As of assessment date, there is zero confirmed in-the-wild exploitation, no KEV listing, and EPSS is 1.1%. The threat is latent, not active — this is a 30-day window to patch before the PoC embargo lifts.

Why not higher?

The chain requires two unpatched vulnerabilities, one of which was fixed a month ago — this is a compounding friction point that meaningfully reduces the exploitable population. There is no public PoC and no active exploitation. The AC:H complexity is genuine, not artificially inflated. Upgrading to CRITICAL would only be warranted if exploitation were active or the PoC were public.

Why not lower?

SharePoint Server is canonically a high-value-role component — the farm service account's SQL and AD privileges create a documented path to domain compromise (Operation FarmKey). This blast radius sets a HIGH floor per role-multiplier rules. Additionally, once the PoC embargo lifts (~September 10), weaponization is expected to be rapid given the existing public PoC for the auth bypass half of the chain. The 1,300+ servers still unpatched against July SharePoint CVEs represent a confirmed population that is likely vulnerable to the full chain.

1. Verify CVE-2026-55040 (July 2026) patch is applied immediately — The full unauthenticated chain requires the July auth bypass to be unpatched. Confirming KB deployment for CVE-2026-55040 eliminates the most dangerous attack path *right now*, even before the August patch is applied. This is your highest-ROI action — deploy within the noisgate HIGH mitigation SLA of 30 days, though given the chain severity, prioritize within 7 days.
2. Restrict internet exposure of SharePoint Server — Place on-premises SharePoint behind a VPN, reverse proxy with pre-authentication (Azure AD App Proxy, Cloudflare Access), or remove direct internet exposure entirely. This eliminates the unauthenticated remote attack vector. Deploy within 30 days per noisgate HIGH mitigation SLA.
3. Disable or restrict Business Connectivity Services — If BCS is not actively used (common in many deployments), disable the BCS service application in Central Administration. This removes the specific attack surface for CVE-2026-63520's gadget chain. Test in non-production first — BCS removal can break external data connections.
4. Rotate the ASP.NET machineKey on all WFE servers — Even after patching, a previously compromised machineKey grants persistent access. Regenerate machineKeys in web.config across all SharePoint web front-ends and redistribute. This is especially critical if you suspect any prior SharePoint compromise in July 2026.
5. Audit farm service account privileges — Ensure the farm account uses a Group Managed Service Account (gMSA) with minimal AD privileges. Remove unnecessary group memberships. This limits blast radius if the account is compromised. Review SQL role assignments — dbcreator and securityadmin should be scoped narrowly.

Run this script on each SharePoint server (WFE and application tier) as a local administrator. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE202663520.ps1. The script checks installed SharePoint build numbers against the patched versions for both CVE-2026-63520 (August) and CVE-2026-55040 (July).

#Requires -RunAsAdministrator
# Check-CVE202663520.ps1
# Checks SharePoint Server patch status for CVE-2026-63520 and CVE-2026-55040
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

try {
    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
} catch {
    Write-Host "UNKNOWN - SharePoint PowerShell snap-in not available. Is this a SharePoint server?"
    exit 2
}

try {
    $farm = Get-SPFarm -ErrorAction Stop
    $build = $farm.BuildVersion
    $version = "$($build.Major).$($build.Minor).$($build.Build).$($build.Revision)"
    Write-Host "Detected SharePoint build: $version"
    Write-Host "Major: $($build.Major) Minor: $($build.Minor) Build: $($build.Build) Rev: $($build.Revision)"

    # Patched builds for CVE-2026-63520 (August 2026 Patch Tuesday)
    $vulnerable = $false
    $chainVulnerable = $false

    if ($build.Major -eq 16) {
        if ($build.Minor -ge 19000) {
            # Subscription Edition
            if ($build.Build -lt 19725 -or ($build.Build -eq 19725 -and $build.Revision -lt 20522)) {
                $vulnerable = $true
                Write-Host "SharePoint Server Subscription Edition - NOT patched for CVE-2026-63520"
            } else {
                Write-Host "SharePoint Server Subscription Edition - Patched for CVE-2026-63520"
            }
        } elseif ($build.Minor -ge 10000) {
            # SharePoint 2019
            if ($build.Build -lt 10417 -or ($build.Build -eq 10417 -and $build.Revision -lt 20198)) {
                $vulnerable = $true
                Write-Host "SharePoint Server 2019 - NOT patched for CVE-2026-63520"
            } else {
                Write-Host "SharePoint Server 2019 - Patched for CVE-2026-63520"
            }
        } elseif ($build.Minor -ge 4000) {
            # SharePoint 2016
            if ($build.Build -lt 5565 -or ($build.Build -eq 5565 -and $build.Revision -lt 1001)) {
                $vulnerable = $true
                Write-Host "SharePoint Server 2016 - NOT patched for CVE-2026-63520"
            } else {
                Write-Host "SharePoint Server 2016 - Patched for CVE-2026-63520"
            }
        } else {
            Write-Host "UNKNOWN - Unrecognized SharePoint 16.x build"
            exit 2
        }
    } else {
        Write-Host "UNKNOWN - Unexpected major version: $($build.Major)"
        exit 2
    }

    # Check BCS service status
    $bcs = Get-SPServiceInstance | Where-Object { $_.TypeName -like "*Business Data*" -or $_.TypeName -like "*Business Connectivity*" }
    if ($bcs) {
        $bcsRunning = $bcs | Where-Object { $_.Status -eq "Online" }
        if ($bcsRunning) {
            Write-Host "WARNING: Business Connectivity Services is RUNNING (attack surface present)"
        } else {
            Write-Host "INFO: Business Connectivity Services is installed but NOT running (reduced attack surface)"
        }
    } else {
        Write-Host "INFO: Business Connectivity Services not found (attack surface absent)"
    }

    if ($vulnerable) {
        Write-Host ""
        Write-Host "VULNERABLE - CVE-2026-63520 patch not applied. Apply August 2026 Patch Tuesday updates."
        exit 1
    } else {
        Write-Host ""
        Write-Host "PATCHED - CVE-2026-63520 fix is applied."
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error querying SharePoint farm: $($_.Exception.Message)"
    exit 2
}

Sources

1. Rapid7 — CVE-2026-63520 SharePoint RCE Disclosure
2. Rapid7 — CVE-2026-55040 SharePoint JWT Auth Bypass
3. Resecurity — From Web Request to Domain Compromise: July 2026 SharePoint Attacks
4. Petri — Over 1,300 Internet-Exposed SharePoint Servers Remain Vulnerable
5. Censys — SharePoint Server Vulnerability Advisory
6. CISA — SharePoint Hardening Advisory
7. The Hacker News — AI-Assisted SharePoint Exploit Chain
8. Help Net Security — August 2026 Patch Tuesday