Executive Summary
Researchers have identified and demonstrated a critical exploit chain targeting Microsoft SharePoint servers, combining a JWT token authentication bypass (CVE-2026-55040) with an unsafe .NET type instantiation vulnerability (CVE-2026-63520). By forging JWT tokens to gain privileged access, attackers can upload malicious Business Data Connectivity Models (BDCM) to the SharePoint server, eventually triggering remote code execution through the Business Connectivity Services (BCS).
The technical workflow involves exploiting the BDC metadata catalog to instantiate arbitrary .NET classes, specifically leveraging the System.Web.UI.LosFormatter class as a deserialization gadget. This bypasses typical authentication requirements and allows unauthenticated attackers to execute system-level commands, such as launching arbitrary processes. CISA and VulnCheck have already noted active exploitation in the wild for the authentication bypass component of this chain.
This threat is highly significant due to the estimated 8,500+ internet-facing SharePoint servers and the history of BDC-related vulnerabilities being targeted by sophisticated actors. Organizations should prioritize patching these specific CVEs, as the availability of functional exploit code increases the risk of immediate wide-scale deployment by threat actors.