PatchaPalooza

CVE-2026-63520: Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint Server, rated Important by Microsoft, with a CVSS 3.1 base score of 8.1 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 0.96% probability of exploitation activity in the next 30 days, higher than 62% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 5 security updates (KB5002905, KB5002906, KB5002894, KB5002896 and more). It affects 3 products in 1 product family (Microsoft Office).

Key facts

CVE ID
CVE-2026-63520
Severity
High CVSS 8.1
Microsoft severity
Important
Impact
Remote Code Execution
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
More Likely
Weakness
CWE-20
EPSS
0.96% (percentile 62%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2026 Patch Tuesday
Product families
Microsoft Office

CVSS score and vector

Microsoft scores CVE-2026-63520 at 8.1 (temporal 7.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

In a network-based attack, an unauthenticated attacker could write arbitrary code to inject and execute code remotely on the SharePoint Server.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

A high attack complexity means that successful exploitation is complex and time‑consuming, requiring significant effort and precise conditions for an attacker to reliably exploit the vulnerability.

There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?

Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.

I am running SharePoint Server 2016. Do the updates for SharePoint Enterprise Server 2016 also apply to the version I am running?

Yes. The same KB number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Customers running either version should install the security update to be protected from this vulnerability.

Affected products (3)

Microsoft Office

ProductSecurity updateTypeFixed buildRestart
Microsoft SharePoint Enterprise Server 2016KB5002905
KB5002906		Security Update
Security Update		16.0.5565.1001
16.0.5565.1001		Maybe
Maybe
Microsoft SharePoint Server 2019KB5002894
KB5002896		Security Update
Security Update		16.0.10417.20198
16.0.10417.20198		Maybe
Maybe
Microsoft SharePoint Server Subscription EditionKB5002893Security Update16.0.19725.20522Maybe

Security updates (5)

Exploitation and detection

VulnCheck KEV

Date added
Ransomware use
Unknown
Independent sources
2

Public exploits (1)

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

NIST NVD data

NVD status
Analyzed
NVD CVSS
8.1 (HIGH)
NVD weakness
CWE-20
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
sharepoint serverbefore 16.0.19725.20522
sharepoint server 2016all listed versions
sharepoint server 2019all listed versions

References

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.

Sources