CVE-2026-63516 Overview
CVE-2026-63516 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server. The flaw allows an authenticated attacker to perform spoofing actions over the network. Microsoft assigned a CVSS 3.1 score of 6.5, reflecting network attack vector, low attack complexity, and low privileges required.
The issue is tracked under CWE-502: Deserialization of Untrusted Data. SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise are affected.
Critical Impact
An authenticated attacker can send crafted serialized data to a vulnerable SharePoint endpoint and induce the server to act on spoofed content, undermining trust boundaries in collaborative workflows.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-08-11 - CVE-2026-63516 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-63516
Vulnerability Analysis
The vulnerability originates in how SharePoint Server processes serialized objects submitted by authenticated users. When SharePoint deserializes attacker-controlled data without sufficient type validation, the runtime instantiates object graphs chosen by the attacker. This behavior enables the server to accept spoofed content as if it originated from a trusted source.
Exploitation requires network access to a SharePoint endpoint and valid credentials with at least low-level privileges. No user interaction is required to trigger the deserialization path. The primary impact is on confidentiality, as spoofed identities or content can expose data to unintended recipients.
Root Cause
The root cause is unsafe deserialization of untrusted input, classified under CWE-502. SharePoint reconstructs .NET objects from serialized payloads without enforcing a strict allowlist of expected types. Attackers exploit this permissive behavior to influence the state of server-side objects used in identity or content workflows.
Attack Vector
An authenticated attacker submits a crafted serialized payload through a SharePoint request that reaches a vulnerable deserialization sink. The server reconstructs the object graph and interprets attacker-controlled fields as legitimate application state. This lets the attacker impersonate other users, forge document metadata, or alter the perceived origin of content within the SharePoint environment. See the Microsoft Security Response Center advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-63516
Indicators of Compromise
- Unexpected serialized object payloads in SharePoint HTTP request bodies, particularly Base64-encoded BinaryFormatter or SoapFormatter blobs.
- SharePoint content or activity logs showing actions attributed to users whose sessions were not authenticated at that time.
- Anomalous w3wp.exe child process activity on SharePoint front-end servers during requests to _layouts, _vti_bin, or _api endpoints.
Detection Strategies
- Inspect Unified Logging Service (ULS) logs for deserialization exceptions, type-load errors, or repeated System.Runtime.Serialization warnings.
- Correlate IIS access logs with SharePoint audit logs to identify authenticated sessions performing spoofing-consistent actions such as unexpected author or ownership changes.
- Apply WAF or IDS signatures for known .NET deserialization gadget markers such as TypeConfuseDelegate, ObjectDataProvider, and WindowsIdentity in POST bodies.
Monitoring Recommendations
- Baseline normal authenticated request patterns per SharePoint user and alert on deviations in content submission volume or object types.
- Forward IIS, ULS, and Windows security logs to a centralized analytics platform for cross-source correlation.
- Monitor for privilege changes, permission grants, and delegate assignments that occur without corresponding administrative approval workflows.
How to Mitigate CVE-2026-63516
Immediate Actions Required
- Apply the security update referenced in the Microsoft advisory for CVE-2026-63516 to all affected SharePoint Server installations.
- Inventory SharePoint Server 2016, 2019, and Subscription Edition farms and confirm each server has ingested the current cumulative update.
- Rotate service account credentials and machine keys on SharePoint farms if suspicious deserialization activity has been observed.
Patch Information
Microsoft has published guidance and update packages through the Microsoft Security Response Center. Administrators should consult the MSRC advisory for CVE-2026-63516 for the exact KB numbers corresponding to their SharePoint edition and install them via Windows Update or the Microsoft Update Catalog.
Workarounds
- Restrict SharePoint access to authenticated users on trusted network segments and require multi-factor authentication for all accounts.
- Enforce least privilege by reviewing site collection administrator and contributor assignments and removing unnecessary permissions.
- Place SharePoint front-end servers behind a web application firewall configured to block known .NET deserialization gadget patterns until patches are deployed.
# Verify installed SharePoint patch level on a server
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, PatchableUnitVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
