CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)
Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.
Rapid7 Labs' zero-day research project on Microsoft SharePoint uncovered two vulnerabilities that, when chained, achieve unauthenticated remote code execution. The second flaw in the chain, CVE-2026-63520, affects all supported versions of Microsoft SharePoint and has been disclosed and fixed. The first chain component, CVE-2026-55040, was disclosed by Rapid7 and Microsoft the previous month.
- CVE-2026-63520 chains with CVE-2026-55040 for unauthenticated RCE
- Affects all supported versions of Microsoft SharePoint
- Coordinated disclosure by Rapid7 and Microsoft with patches available
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server | 8.1 | 3% |
From the original article
Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520.
By Stephen Fewer · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.