What is the CVSS score of CVE-2026-63520?

CVE-2026-63520 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Microsoft SharePoint are affected by CVE-2026-63520?

Microsoft SharePoint is vulnerable to unauthenticated remote code execution affecting Enterprise Server 2016, Server 2019, and Subscription Edition.. A patch is available.

Is there a public PoC exploit available for CVE-2026-63520?

Yes, a public proof-of-concept exploit is available for CVE-2026-63520. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2026-63520?

Within 24 hours, identify and catalog all Microsoft SharePoint instances (Enterprise Server 2016, Server 2019, Subscription Edition) in your environment and prioritize them by business criticality. Within 7 days, obtain and stage Microsoft's patches for each affected product line, conduct testing in a controlled environment, and begin coordinated deployment to non-production systems. Within 30 days, complete full deployment of patches to all production SharePoint instances and verify remediation across your estate.

Microsoft SharePoint CVE-2026-63520

EUVD-2026-56298 HIGH

Improper Input Validation (CWE-20)

2026-08-11 secure@microsoft.com

GHSA-cj4w-v2c3-7qjr

Authentication Bypass Microsoft Sharepoint Server

8.1

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

8.1 HIGH

Network-accessible unauthenticated RCE with AC:H reflecting unspecified exploitation precondition; full C/I/A from code execution; scope unchanged as impact is confined to the SharePoint server.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:51 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.1

DescriptionCVE.org

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Articles & Coverage 1

POC Unauthenticated RCE on SharePoint: CVE-2026-55040 JWT Bypass Chained with CVE-2026-63520 Type Instantiation Aug 26, 2026

AnalysisAI

Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation) in Microsoft SharePoint, a widely deployed enterprise collaboration and document management platform built on ASP.NET and hosted via IIS. The failure to validate attacker-supplied network input allows code execution - consistent with the 'Authentication Bypass' tag, which suggests the validation flaw occurs at or before an authentication boundary, enabling attackers to reach privileged execution paths without credentials. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) indicates the vulnerability is network-exposed and requires no user interaction or privileges, but High Attack Complexity (AC:H) implies a specific precondition - such as a race condition, particular server state, or protocol sequence - must be satisfied. Affected CPE-equivalent product lines span SharePoint 2016 (versions below 16.0.5565.1001), SharePoint 2019 (below 16.0.10417.20198), and the Subscription Edition (below 16.0.19725.20522), as confirmed by EUVD-2026-56298.

RemediationAI

The primary fix is to apply vendor-released patches from Microsoft immediately. Upgrade SharePoint Enterprise Server 2016 to version 16.0.5565.1001 or later, SharePoint Server 2019 to version 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to version 16.0.19725.20522 or later. Full patch guidance and downloads are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520. If patching cannot be completed immediately, restrict inbound network access to SharePoint servers from untrusted or internet-facing segments at the firewall or load-balancer level - this partially mitigates AV:N exposure but trades off legitimate remote access and may not be viable for externally published SharePoint deployments. Enabling enhanced IIS and SharePoint ULS audit logging during the patching window allows detection of anomalous unauthenticated request patterns. No workaround eliminates the underlying CWE-20 flaw; patching is the only complete remediation.