What is the CVSS score of CVE-2026-63514?

CVE-2026-63514 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of Microsoft SharePoint are affected by CVE-2026-63514?

Microsoft SharePoint Server (2019, 2016, and Subscription Edition) contains a critical remote code execution vulnerability (CVE-2026-63514, CVSS 8.8) that allows any low-privileged internal user to…. A patch is available.

How to fix or mitigate CVE-2026-63514?

Within 24 hours, conduct a complete inventory of all Microsoft SharePoint Server 2019, 2016, and Subscription Edition deployments and immediately apply the vendor-released security patch from Microsoft to all instances, verifying successful deployment through change tracking. Within 7 days, audit SharePoint administrative access and network logs for suspicious activity targeting administrative functions, and implement role-based access controls to restrict low-privilege user capabilities on sensitive operations. Within 30 days, perform comprehensive security assessment of all SharePoint infrastructure, implement network segmentation to isolate SharePoint systems from critical business services, and establish automated patch management processes to prevent future critical patch delays.

Microsoft SharePoint CVE-2026-63514

EUVD-2026-56295 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secure@microsoft.com

GHSA-vcv9-wr6m-p5qc

Deserialization Microsoft Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable deserialization requiring only a low-privilege account; no user interaction; full CIA impact on the vulnerable server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:53 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft SharePoint Server affects authenticated network users through unsafe deserialization of attacker-controlled data. Affected versions span SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Server Subscription Edition - all running build numbers below the patched releases issued by Microsoft. An attacker with a valid low-privilege account can send a crafted payload over the network to trigger arbitrary code execution on the server without any user interaction, achieving full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity, network-reachable attack surface makes this a high-priority patching target.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause: SharePoint deserializes attacker-supplied objects without sufficient validation, allowing type confusion or gadget-chain abuse common to .NET deserialization vulnerabilities. Microsoft SharePoint Server is a .NET-based collaboration platform that processes complex serialized data in multiple workflows (list data, workflows, web parts). Affected CPE-mapped products include SharePoint Server 2019 (versions 16.0.0 through pre-16.0.10417.20198), SharePoint Enterprise Server 2016 (versions 16.0.0 through pre-16.0.5565.1001), and SharePoint Server Subscription Edition (versions 16.0.0 through pre-16.0.19725.20522). Deserialization gadget chains in .NET environments can achieve full remote code execution by abusing existing classes in the application's loaded assemblies.

RemediationAI

Apply the Microsoft-released patches immediately: upgrade SharePoint Server 2019 to build 16.0.10417.20198 or later, SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20522 or later. Full patch details are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63514. If immediate patching is not possible, restrict SharePoint access to known, trusted authenticated users only and enforce network-level controls (firewall rules, VPN requirements) to prevent unapproved accounts from reaching the SharePoint web front-end - note that this does not eliminate the risk but raises the bar for opportunistic exploitation. Auditing SharePoint authentication logs for anomalous serialized data submissions may help detect attempted exploitation while patching is underway.