The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check which SharePoint product and exact build you are running (SharePoint Server 2016, 2019, Subscription Edition, or another SharePoint Server deployment).
Compare your current build against the fixed versions: 16.0.19725.20522 (SharePoint Server / Subscription Edition), 16.0.5565.1001 (SharePoint Enterprise Server 2016), and 16.0.10417.20198 (SharePoint Server 2019).
Upgrade/apply the official Microsoft update for CVE-2026-63512 so your SharePoint build matches or exceeds the fixed version for your product.
After patching, review SharePoint audit/activity logs for unexpected changes to documents, lists, or sites by accounts that normally wouldn’t perform those actions.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
In plain language
Written by AI from the record
If someone already has a valid, low-privilege login to your Microsoft SharePoint Server, they may be able to tamper with data they shouldn’t—this is a patch you should prioritize for SharePoint admins.
CVE-2026-63512 is an authenticated authorization flaw (CWE-863) in Microsoft SharePoint Server that allows a low-privileged user to tamper with information over the network due to incorrect access-right handling.
If you're affected
Unauthorized data changes
Corrupted collaboration content
Loss of customer trust
Increased breach fallout risk
What is it
This vulnerability is like giving someone a small office key but accidentally letting them access rooms they weren’t supposed to. In this case, a logged-in user with limited permissions may be able to alter or corrupt data inside your SharePoint environment over the network. If that happens, it can lead to changed files or content that doesn’t reflect what your business intended.
Who is affected
This matters if you run Microsoft SharePoint Server 2016, 2019, or the SharePoint Server Subscription Edition, because the flaw is in SharePoint’s authorization handling. It mainly becomes a risk when an attacker already has valid credentials (even low-privileged ones), since the vulnerability requires authentication. The practical gate is: a risk only if an attacker can log in to SharePoint with low-level permissions.
How urgent is it
This is RED because the issue enables tampering by an authenticated low-privilege user, which can quickly turn into real business impact if credentials are abused. Also, security attention is high enough to have been actively associated with the Lazarus group in this patch cycle, and the fix is available for all affected SharePoint lines.
What to do — in detail
Confirm exposure in your environment
Identify which exact SharePoint product you use (SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition, or SharePoint Server).
Determine your current SharePoint build number.
Decide whether you are affected by checking whether your build is earlier than the fixed versions:
SharePoint Server and SharePoint Server Subscription Edition: fixed in 16.0.19725.20522
SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
SharePoint Server 2019: fixed in 16.0.10417.20198
Patch / upgrade
Apply the official Microsoft update for CVE-2026-63512 from Microsoft’s update guide.
Upgrade to at least the fixed build for your specific SharePoint product line (listed above).
Plan for normal SharePoint update procedure in your maintenance window.
Validate after patching
Re-check the SharePoint build number to confirm it matches or exceeds the fixed version for your product.
Review SharePoint audit/activity logs for suspicious tampering patterns, such as:
unexpected edits to documents/lists/sites,
changes performed by accounts that usually have limited roles,
repeated permission-like actions followed by content changes.
If you cannot patch immediately
Reduce the chance that an attacker has valid SharePoint credentials by tightening account security (password resets for at-risk users, enforce MFA where applicable, and promptly disable stale accounts).
Recheck role assignments for low-privilege users and ensure they only have the minimum permissions needed.
Increase monitoring of SharePoint change events and investigate anything out of the ordinary.
Where to track the fix
Follow Microsoft’s update guide for CVE-2026-63512 to ensure you apply the correct package for your environment.
CISA KEV status
This CVE is not listed in CISA KEV (per the provided findings), but it still has an available fix and is marked RED for urgency based on the tampering authorization risk and security attention during this cycle.
Technical context
CVE-2026-63512 is an authenticated authorization/tampering issue (CWE-863) in Microsoft SharePoint Server. The mechanism is incorrect handling of access rights that lets a low-privileged authenticated attacker tamper with information over the network.
Exploitation status
No public exploit code was found in the provided findings.
KEV: not listed in CISA KEV.
Real-world reporting: no clear dated press claim of exploitation for this specific CVE in the provided findings.
Risk drivers in this case
Network reachability is present in the vulnerability description, but authentication is required; the attacker must already have valid credentials.
Because the impact is tampering (integrity impact), a compromised or abused low-privilege account can still cause meaningful damage (e.g., corrupting content).
Patch information
Fixed builds are available for all affected SharePoint lines: 16.0.19725.20522 (SharePoint Server / Subscription Edition), 16.0.5565.1001 (SharePoint Enterprise Server 2016), and 16.0.10417.20198 (SharePoint Server 2019).
EPSS
EPSS is a prediction and is not used as proof of exploitation here; KEV/news do not confirm exploitation for this CVE in the provided findings.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
