SharePoint RCE detections keyed to one exploit will miss the other, after CVE-2026-63520 leaks early

The grace period was the point of holding the writeup. Rapid7 says it planned to publish 30 days after the August 11 disclosure and moved the analysis up only because a third party put details out first ^[2]. What that early publication changed is not the vulnerability but its detectability, and that is the part defenders have to sit with.

The bug lives in SharePoint's Business Data Connectivity subsystem. In `DbTypeReflector.ResolveDotNetType()`, the attacker-controlled `TypeName` from a BDC model is passed straight to `Type.GetType()` with no allowlist ^[9]. There is a length gate: names under 15 characters fall through to a limited base path, but anything 15 characters or longer resolves directly, which is enough room for `System.Windows.Data.ObjectDataProvider` or any other assembly-qualified type in the GAC ^[10]. Upload a malicious `.bdcm` model, trigger entity execution, set properties, and a setter side-effect reaches OS command execution ^[8]. On its own that is authenticated code execution as the site service account ^[3]; bolt on the CVE-2026-55040 authentication bypass and the chain is unauthenticated ^[4].

The consequence sits in how two teams reached the same primitive. Rapid7 got there with a Database LOB system and an `ObjectDataProvider` gadget chain; VulnCheck used a `DotNetAssembly` LOB system and a `LosFormatter` chain ^[5]. That is at least two distinct exploit paths in public, both landing on the same instantiation flaw [c6d]. A detection written around the ObjectDataProvider payload does not fire on the LosFormatter one, and vice versa. Rapid7's own read is that more chains are likely ^[6], so any rule built on today's two payloads is already behind the next one.

The durable signal is the primitive, not the gadget: a BDC model that resolves a long, arbitrary assembly-qualified type through the reflector, regardless of which class the attacker eventually instantiates. This is not a new failure mode for the subsystem either. Rapid7 credits ZDI's CVE-2019-1257 writeup, which covered leveraging BDC models for unsafe .NET type instantiation, as prior work ^[12]. The analysis was carried out against SharePoint Server Subscription Edition build 16.0.19725.20210 ^[11].