CVE-2026-63520: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-63520 Overview

CVE-2026-63520 is an improper input validation vulnerability [CWE-20] in Microsoft Office SharePoint Server. An unauthenticated attacker can execute arbitrary code over a network by submitting crafted input that SharePoint fails to validate before processing. The flaw affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory on August 11, 2026, and updated it on August 13, 2026. The attack requires no privileges and no user interaction, though the CVSS vector indicates high attack complexity.

Critical Impact
Successful exploitation grants remote code execution on the SharePoint server, exposing confidential documents, enabling lateral movement, and compromising integrity and availability of collaboration infrastructure.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-63520 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-63520

Vulnerability Analysis

CVE-2026-63520 stems from improper input validation [CWE-20] within Microsoft Office SharePoint Server request handling. SharePoint processes attacker-supplied data without enforcing correct type, length, format, or structural checks. This allows a remote, unauthenticated adversary to submit crafted network traffic that coerces the server into executing arbitrary code within the SharePoint worker process context. The result is a full compromise of confidentiality, integrity, and availability on the affected server. The EPSS probability is 1.122% at the 63.31 percentile, and no public proof-of-concept or in-the-wild exploitation has been documented at the time of publication.

Root Cause

SharePoint accepts network input into a processing path that fails to sanitize or constrain untrusted values before they influence code execution flow. Missing input validation of this type commonly enables downstream weaknesses such as unsafe deserialization, injection, or type confusion inside SharePoint handlers. Microsoft has not published low-level root cause details in the public advisory.

Attack Vector

The attacker delivers a malicious request to an exposed SharePoint endpoint over the network. No authentication or user interaction is required, but the high attack complexity implies the attacker must satisfy specific runtime conditions or timing constraints. Internet-facing SharePoint farms and multi-tenant intranets present the highest exposure. Successful exploitation yields code execution as the SharePoint application identity, which typically holds broad access to content databases and search indexes.

No verified public exploit code is available. See the Microsoft Security Update Guide for CVE-2026-63520 for authoritative technical details.

Detection Methods for CVE-2026-63520

Indicators of Compromise

Unexpected w3wp.exe child processes spawning cmd.exe, powershell.exe, or scripting hosts on SharePoint servers.
New or modified .aspx, .ashx, or .asmx files under SharePoint web application directories, particularly LAYOUTS and _vti_bin.
Outbound network connections from SharePoint application pool identities to previously unseen external hosts.
Anomalous POST requests to SharePoint endpoints containing large or malformed payloads immediately preceding suspicious process activity.

Detection Strategies

Monitor IIS logs for high-entropy or oversized request bodies targeting SharePoint handlers, correlated with HTTP 500 responses followed by successful 200s.
Baseline expected process trees for w3wp.exe on SharePoint hosts and alert on deviations, especially command interpreter or certutil.exe invocations.
Deploy YARA and file integrity monitoring on SharePoint webroots to flag newly written server-side scripts and web shells.

Monitoring Recommendations

Forward SharePoint ULS logs, IIS access logs, and Windows Security event logs to a centralized analytics platform for correlation.
Track authentication anomalies and privilege changes on service accounts associated with SharePoint application pools.
Alert on execution of LOLBins (bitsadmin, mshta, regsvr32) originating from the SharePoint worker process.

How to Mitigate CVE-2026-63520

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-63520 to all SharePoint Server 2016, 2019, and Subscription Edition instances.
Inventory internet-exposed SharePoint endpoints and restrict access to trusted networks or a reverse proxy with request inspection until patching completes.
Rotate SharePoint machine keys and service account credentials on any host suspected of exposure prior to patching.
Hunt retroactively for the indicators listed above across at least 30 days of telemetry.

Patch Information

Microsoft has released security updates addressing CVE-2026-63520. Refer to the Microsoft Security Update Guide for CVE-2026-63520 for the exact KB articles applicable to each SharePoint version and edition. Install the update on all Web Front End and Application servers in the farm, then run the SharePoint Products Configuration Wizard.

Workarounds

Place SharePoint behind a web application firewall configured to inspect and block malformed request payloads.
Enforce network segmentation so that SharePoint servers cannot initiate arbitrary outbound connections.
Run SharePoint application pools under least-privilege service accounts to constrain post-exploitation impact.
Disable or restrict access to unused SharePoint web services and endpoints exposed via _vti_bin and LAYOUTS.

bash

# Verify SharePoint patch level on a Windows server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# List installed SharePoint updates via PowerShell
Get-SPProduct -Local | Format-List DisplayName, PatchableUnitDisplayNames, Patches