Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).

Do: Apply Microsoft's Patch Tuesday security updates for SharePoint Server as soon as possible, prioritizing internet-facing farms, since the flaw requires no authentication and grants code execution. As interim mitigation, restrict network exposure of SharePoint front-ends (VPN/WAF/reverse proxy rules) and verify all farm servers receive the update. Monitor vendor advisories and the Rapid7 analysis for details on the vulnerable code paths, since no public PoC or in-the-wild exploitation has been confirmed yet.