{"id":"CVE-2026-63520","published":"2026-08-11T17:03:31Z","modified":"2026-10-30T17:19:16Z","title":"Microsoft SharePoint Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","versions":[">= 16.0.0, < 16.0.5565.1001"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","versions":[">= 16.0.0, < 16.0.10417.20198"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server Subscription Edition","versions":[">= 16.0.0, < 16.0.19725.20522"]}],"description":{"text":"Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00956,"percentile":0.61387,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-25","exploitedFirstSeen":"2026-08-25","ransomware":false,"evidence":[{"url":"https://x.com/DefusedCyber/status/2092228764323217723","date":"2026-08-25"},{"url":"https://previdian.com/CVE-2026-63520","date":"2026-08-26"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"EbeeOct2026 Pt1","url":"https://otx.alienvault.com/pulse/6ace88556446ffa62c5a709c","created":"2026-10-13"},{"name":"SMTP is the key: BPFDoor and AVERAT hitting the network edge","url":"https://otx.alienvault.com/pulse/6ac47c8beb61cbe1439f50ed","created":"2026-10-06"},{"name":"SMTP is the key: BPFDoor and AVERAT hitting the network edge.","url":"https://otx.alienvault.com/pulse/6ac0a6646f768b78f7b38f01","created":"2026-10-03"},{"name":"SMTP is the key: BPFDoor and AVERAT hitting the network edge","url":"https://otx.alienvault.com/pulse/6abfb61b65922c3229d35cf8","created":"2026-10-02"},{"name":"ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories","url":"https://otx.alienvault.com/pulse/6a906c21774296d1a8d3121b","created":"2026-08-27"},{"name":"Microsoft SharePoint Unauth RCE Chain: CVE-2026-55040 + CVE-2026-63520","url":"https://otx.alienvault.com/pulse/6a8fd35ddde27196aee4ad9d","created":"2026-08-27"},{"name":"SharePoint CVE-2026-55040 Exploited After PoC (+ CVE-2026-63520 RCE Chain)","url":"https://otx.alienvault.com/pulse/6a80013ebe3a59b368ffdf56","created":"2026-08-15"},{"name":"Microsoft SharePoint Unauth RCE Chain: CVE-2026-55040 + CVE-2026-63520","url":"https://otx.alienvault.com/pulse/6a7c0d230ce164321213feb7","created":"2026-08-12"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520","tags":["vendor-advisory","patch"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-56298","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56298","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-08-26","earliestUrl":"https://github.com/hypnguyen1209/CVE-2026-63520","repos":[{"name":"hypnguyen1209/CVE-2026-63520","url":"https://github.com/hypnguyen1209/CVE-2026-63520","stars":1,"created":"2026-08-26"}]},"first":{"date":"2026-08-26","source":"PoC-in-GitHub","url":"https://github.com/hypnguyen1209/CVE-2026-63520"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-08-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-63520","provenance":"source"},{"date":"2026-08-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/DefusedCyber/status/2092228764323217723","provenance":"source"},{"date":"2026-08-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hypnguyen1209/CVE-2026-63520","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":70.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 67 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.28,"detail":"percentile 0.6139"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-sharepoint-cwe-20"}}