CVE-2026-63514

This vulnerability lets someone who already has an account for SharePoint send “poisoned” data to the server. If they do, SharePoint can be tricked into running harmful commands, like an attacker handing the server a malicious instruction set. In a worst case, that can lead to full control of the server and damage to business operations.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including environments described as “sharepoint server”).

Because this requires valid authentication to access SharePoint, it’s mainly a risk if an attacker can log in (for example, via stolen credentials or an account takeover). It becomes dangerous when your SharePoint is reachable from where attackers can attempt authenticated access.

This is RED because the flaw is capable of remote code execution and requires only an authenticated attacker to trigger it. Even though there’s no confirmed public exploitation for this specific CVE in the reporting you provided, this class of weakness is exactly what attackers use once they have a foothold.

Patch it urgently to remove the path from an authenticated attacker to full server compromise.

1. Inventory your SharePoint deployment

   • Identify which of these you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition (also described as “sharepoint server”).
   • Record the current SharePoint build/version.

2. Determine whether you’re affected

   • Compare your current version/build to the Microsoft fixed versions:
     • Enterprise Server 2016 fixed in 16.0.5565.1001
     • Server 2019 fixed in 16.0.10417.20198
     • Subscription Edition / sharepoint server fixed in 16.0.19725.20522
   • If your version is older than the fixed version for your product, you’re affected.

3. Patch

   • Install the Microsoft update referenced in the MSRC update guide for CVE-2026-63514.
   • After installation, verify the SharePoint version/build is now at (or above) the fixed version listed for your branch.

4. If patching is delayed (temporary risk reduction)

   • Reduce the chance of credential abuse:
     • Tighten who can authenticate to SharePoint (remove unused accounts, enforce least privilege).
     • Strengthen sign-in protections (for example, ensure multi-factor authentication is in place for SharePoint sign-ins, if your setup supports it).
   • Monitor for suspicious activity:
     • Look for unusual login attempts or anomalous behavior in SharePoint and web/app logs around the SharePoint endpoints.
   • This does not remove the vulnerability, but it lowers the likelihood an attacker can authenticate and attempt the attack.

5. What to monitor after patching

   • Confirm no errors in SharePoint services after the update.
   • Continue monitoring authentication logs for abnormal sign-in patterns, since the vulnerability requires authenticated access.

CVE-2026-63514 is a Microsoft SharePoint Server remote code execution issue tied to CWE-502 (deserialization of untrusted data).

Mechanism: an attacker who is authenticated to Microsoft Office SharePoint can send specially crafted data over the network that results in the server executing harmful commands. The findings explicitly state: Execute arbitrary code after sending specially crafted data through a network connection; authentication is required; no user interaction is required.

Exploitation status: not listed in CISA KEV. The provided news summary does not attribute in-the-wild exploitation to this specific CVE (it mentions active exploitation of a different zero-day, CVE-2026-68820, during the same Patch Tuesday). No public exploit code is on record.

Risk indicators: the traffic-light verdict for this CVE is RED, reflecting the high-impact remote code execution capability and confirmed remediation availability from Microsoft. EPSS is provided as a prediction (do not treat as proof of exploitation).

Actor note from findings: PULSE reports “actor: Lazarus group” and “press attention: new, reason: patch,” indicating heightened threat context around the topic, though the findings do not provide direct proof that Lazarus used this exact CVE in the wild.