High severity8.1NVD Advisory· Published Aug 11, 2026· Updated Aug 13, 2026
CVE-2026-63520
CVE-2026-63520
Description
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Affected products
4cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*+ 2 more
- cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*range: <16.0.19725.20522
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520nvdPatchVendor Advisory
News mentions
16- September 2026 Patch Tuesday forecast: All we need is more timeHelp Net Security · Sep 4, 2026
- ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New StoriesThe Hacker News · Aug 27, 2026
- Two Microsoft SharePoint Flaws Can Be Chained to Hack Servers Without a PasswordCyber Security News · Aug 26, 2026
- Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)Rapid7 Blog · Aug 24, 2026
- Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)Help Net Security · Aug 13, 2026
- Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC ReleaseCyber Security News · Aug 13, 2026
- SharePoint Vulnerability Exploited Shortly After PoC ReleaseSecurityWeek · Aug 12, 2026
- Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)Help Net Security · Aug 12, 2026
- Microsoft SharePoint Server Vulnerability Allows Attackers to Inject and Execute Malicious Code RemotelyCyber Security News · Aug 12, 2026
- Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilitiesCisco Talos Intelligence · Aug 11, 2026
- Patch Tuesday - August 2026Rapid7 Blog · Aug 11, 2026
- Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active AttackThe Hacker News · Aug 11, 2026
- Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)Tenable Blog · Aug 11, 2026
- Microsoft Patch Tuesday Update August 2026 – 394 Vulnerabilities Fixed, Including 3 Zero-DaysCyber Security News · Aug 11, 2026
- Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCEThe Hacker News · Aug 11, 2026
- CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)Rapid7 Blog · Aug 11, 2026