CVE-2026-63520

Microsoft SharePoint Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.18.1High EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your SharePoint Server version (2016, 2019, or Subscription Edition) and compare it to the fixed versions listed below.
If you are on an affected version, upgrade SharePoint Server to the fixed version for your edition (see “what_to_do_full”).
After upgrading, verify the new build number matches the fixed version and confirm SharePoint services start normally.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-63520 is a SharePoint Server security flaw where someone can run code over the network without logging in; if you host Microsoft SharePoint Server 2016/2019/Subscription Edition, you should act now to update to the fixed versions.

CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint Server caused by improper input validation, enabling an unauthorized attacker to trigger code execution over the network; patching is available for SharePoint Server 2016, 2019, and Subscription Edition.

If you're affected

Full server takeover
Customer and business data theft
Service disruption
Ransomware enablement

What is it

This vulnerability is like a bad “door lock” in SharePoint: an attacker can send specially crafted network requests and make the server run code they choose. For a business, that can mean the attacker gets control of the SharePoint server or uses it to reach sensitive files and disrupt services.

Who is affected

This matters to you if your business runs or hosts Microsoft SharePoint Server (SharePoint Server, SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) on your premises or in your managed environment. The risk is specifically about remote access: it is for an attacker who can reach the SharePoint server over the network, and it does not require valid login.
Only consider exposure if your SharePoint server is reachable from the internet and you are running a version that is not at the fixed build.

How urgent is it

This is RED because press reporting indicates active exploitation activity tied to the Lazarus group. Even though we don’t have a CISA KEV entry or public exploit code on record, the combination of remote code execution plus reported exploitation means attackers may already be targeting vulnerable deployments.
Treat this as an immediate patch priority and update to the fixed build as soon as possible.

What to do — in detail

Confirm exposure

Identify which product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
Obtain the current SharePoint build number (the 16.0.x.y build value shown in your SharePoint server version/build details).
Compare your build to the vendor’s fixed versions:
- SharePoint Server: fixed in 16.0.19725.20522
- Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
- Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198
- Microsoft SharePoint Server Subscription Edition: fixed in 16.0.19725.20522

Upgrade / remediation

If your build is older than the fixed version for your edition, install Microsoft’s patch for CVE-2026-63520 using the official Update Guide.
Reboot or restart SharePoint components if required by the update process, then verify SharePoint services are healthy.
Confirm after installation that the build number matches the fixed version for your edition.

Temporary workaround (if patching is delayed)

Reduce the chance an attacker can reach SharePoint:
- Ensure SharePoint is not directly exposed to the internet unless absolutely required.
- If it must be reachable, restrict inbound access to trusted IP addresses and approved network paths.
  (This does not “fix” the flaw, but limits exposure while you patch.)

What to monitor

Review SharePoint and web server logs for unusual request patterns around the time of the patch window and watch for repeated failed or anomalous requests.
Look for unexpected changes such as new admin accounts, unexpected application behavior, or new scheduled tasks tied to the SharePoint host.

CISA due date

No CISA KEV listing was provided for this CVE, so no CISA-specific due date is available from the provided findings.

Technical context

What kind of flaw

CVE-2026-63520 is an input validation issue (CWE-20) in Microsoft Office SharePoint that can be triggered by an unauthorized attacker to execute code over a network.

Exploitation status (what we know)

KEV: not listed in CISA KEV.
Public exploit code: no public exploit code on record.
Reported activity: press attention indicates exploitation activity associated with the Lazarus group.

Predicted likelihood

EPSS data is available as a prediction (trend flat), but public-facing action priority is driven by the reported exploitation activity.

Attack vector and preconditions

The weakness is reachable remotely (network-based) and does not require user interaction or a valid login, per the provided description. Practically, risk depends on whether the attacker can reach the SharePoint Server service.

Fixed versions

The vendor-fixed build numbers are provided in the findings and should be used to verify remediation:

SharePoint Server: 16.0.19725.20522
SharePoint Enterprise Server 2016: 16.0.5565.1001
SharePoint Server 2019: 16.0.10417.20198
SharePoint Server Subscription Edition: 16.0.19725.20522

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 4 days, from the signal feeds we watch.

2026-08-15OpenVAS check added
2026-08-13Patch availablerecord updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / collaboration-groupware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable