CVE-2026-63514: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-63514 Overview

CVE-2026-63514 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint Server. An authenticated attacker can execute arbitrary code over a network by sending crafted serialized data to the server. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory on August 11, 2026, and assigned a CVSS 3.1 base score of 8.8. Exploitation requires low-privilege authentication and no user interaction, and results in full compromise of confidentiality, integrity, and availability on the SharePoint server.

Critical Impact
An authenticated attacker with low privileges can achieve remote code execution on SharePoint servers, enabling data theft, lateral movement, and full server compromise.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-63514 published to NVD and Microsoft advisory released
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63514

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled data within Microsoft SharePoint Server. SharePoint components accept serialized objects and reconstruct them without validating type safety or object provenance. When the server processes a malicious payload, gadget chains embedded in the serialized stream trigger arbitrary code execution in the context of the SharePoint worker process. Because SharePoint runs with elevated service privileges, successful exploitation grants the attacker meaningful control over the host and access to content databases. The EPSS score of 1.257% (66th percentile) indicates elevated exploitation likelihood relative to the broader CVE population, and SharePoint deserialization flaws have a strong historical track record of weaponization.

Root Cause

The root cause is deserialization of untrusted data [CWE-502] in a SharePoint request handler. The handler invokes a .NET deserializer such as BinaryFormatter, LosFormatter, or ObjectStateFormatter on input reachable by authenticated users. Missing type allowlists let attackers instantiate arbitrary types during graph reconstruction. Chained gadgets then reach methods that execute code, load assemblies, or spawn processes.

Attack Vector

The attack vector is network-based against SharePoint HTTP endpoints. The attacker authenticates with any valid low-privilege SharePoint account and submits a crafted request containing a malicious serialized object. The deserializer processes the payload, triggers the gadget chain, and executes commands under the SharePoint application pool identity. No user interaction is required, and the scope remains unchanged, but the impact covers full read, write, and denial capabilities against the server.

No verified public proof-of-concept code is available at the time of publication. Refer to the Microsoft CVE-2026-63514 Advisory for authoritative technical details.

Detection Methods for CVE-2026-63514

Indicators of Compromise

Unexpected child processes such as cmd.exe, powershell.exe, or w3wp.exe-spawned utilities under the SharePoint application pool identity.
Anomalous .aspx or webshell files written under SharePoint web application directories such as TEMPLATE\LAYOUTS.
Outbound network connections from SharePoint worker processes to unknown external hosts.
SharePoint ULS log entries showing deserialization exceptions or unhandled type resolution errors.

Detection Strategies

Monitor IIS request logs for POST requests to SharePoint endpoints carrying base64-encoded serialized payloads or unusually large __VIEWSTATE parameters.
Alert on process creation events where w3wp.exe spawns interactive shells, script interpreters, or reconnaissance binaries.
Baseline authenticated request patterns per SharePoint account and flag deviations that follow login events from new IPs.
Deploy YARA and behavioral rules that flag known .NET deserialization gadget chains (TypeConfuseDelegate, ObjectDataProvider, WindowsIdentity).

Monitoring Recommendations

Forward IIS, SharePoint ULS, and Windows Security event logs to a centralized SIEM for correlation.
Track file integrity across SharePoint hive directories and wwwroot to identify webshell deployment.
Review authentication logs for low-privilege accounts issuing high volumes of API or web service calls.

How to Mitigate CVE-2026-63514

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-63514 to all SharePoint Server 2016, 2019, and Subscription Edition farms without delay.
Rotate the SharePoint server-side machine keys after patching to invalidate any pre-computed __VIEWSTATE payloads.
Audit SharePoint accounts for unexpected privilege changes or new administrative memberships since August 11, 2026.
Restrict SharePoint access to trusted networks or VPN endpoints while patch deployment is in progress.

Patch Information

Microsoft released fixes on August 11, 2026, distributed through Windows Update, Microsoft Update Catalog, and WSUS. Administrators should install the SharePoint-specific security update matching their edition and confirm build numbers post-installation. See the Microsoft CVE-2026-63514 Advisory for the exact KB identifiers.

Workarounds

Enable Antimalware Scan Interface (AMSI) integration in SharePoint to inspect request payloads for malicious content.
Enforce least privilege on SharePoint accounts to limit which users can reach the vulnerable endpoints.
Place SharePoint behind a web application firewall configured to inspect and block suspicious serialized payloads.
Disable unused SharePoint web services and features that expose deserialization surfaces.

bash

# Verify SharePoint patch level after applying the security update
Get-SPFarm | Select-Object BuildVersion
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-08-11') }

# Rotate SharePoint machine keys post-patch
Update-SPMachineKey -WebApplication https://sharepoint.example.com