CVE-2026-63520 is a high-severity remote code execution vulnerability affecting supported on-premises Microsoft SharePoint Server deployments. Microsoft disclosed the vulnerability on August 11, 2026 as part of its August security updates and assigned it a CVSS v3.1 score of 8.1 High.

The short Microsoft description initially looked relatively generic: improper input validation in Microsoft Office SharePoint could allow an unauthorized attacker to execute code over a network. Microsoft classified the weakness as CWE-20, Improper Input Validation. The CVSS vector is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

That combination matters. The vulnerability is remotely reachable, requires no user interaction, and potentially compromises confidentiality, integrity, and availability completely. The principal factor keeping the score below the Critical range is its High attack complexity. (NVD)

What makes CVE-2026-63520 substantially more interesting than the original advisory suggested is what researchers subsequently discovered about the underlying code path.

Rapid7, whose researcher Stephen Fewer originally discovered the issue, later published technical research showing that the vulnerability resides in SharePoint’s Business Data Connectivity, commonly referred to as BDC or Business Connectivity Services. At a high level, SharePoint can be induced to resolve attacker-influenced .NET type information from a Business Data Connectivity model without sufficiently restricting which types may be instantiated.

That seemingly small design weakness can ultimately cross the boundary from data processing into arbitrary operating-system command execution. (daily.dev)

More importantly, CVE-2026-63520 is the second component of a SharePoint vulnerability chain discovered during the same Rapid7 research project.

The first component, CVE-2026-55040, is a critical SharePoint JWT authentication bypass disclosed and patched in July 2026. When the two vulnerabilities are combined, an attacker can move from an unauthenticated network position to code execution on the SharePoint server.

That authentication-bypass vulnerability is no longer merely theoretical. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, 2026 after confirming active exploitation. (NVD)

For organizations operating internet-accessible SharePoint farms, this changes the risk calculation considerably.

CVE-2026-63520 at a Glance

属性	CVE-2026-63520
CVE	CVE-2026-63520
製品	Microsoft SharePoint Server
脆弱性タイプ	リモートコード実行
Root weakness	Improper Input Validation
CWE	CWE-20
CVSS v3.1	8.1 High
攻撃ベクトル	ネットワーク
Attack complexity	高い
Privileges required	None according to Microsoft CVSS
User interaction	なし
Confidentiality impact	高い
Integrity impact	高い
Availability impact	高い
Public disclosure	August 11, 2026
Researcher	Stephen Fewer, Rapid7
Patch available	はい
CISA KEV for CVE-2026-63520	Not listed at the time of writing
Related exploited vulnerability	CVE-2026-55040

Microsoft’s CVE record lists SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition as affected. (NVD)

What Is CVE-2026-63520?

CVE-2026-63520 is fundamentally a failure to maintain a safe boundary between data-controlled type information そして executable .NET behavior.

SharePoint’s Business Connectivity Services are designed to let SharePoint interact with external business systems and data sources. Administrators can describe external systems, entities, methods, fields, and their associated data types through BDC metadata models.

This makes BDC extremely flexible.

It also means SharePoint must interpret information inside those models.

The security problem arises when information that should be treated as declarative metadata can influence which .NET objects SharePoint creates.

Rapid7’s later technical analysis identified a relevant path involving the DbTypeReflector functionality. In particular, SharePoint eventually resolves a .NET type based on type information supplied through a BDC model.

Conceptually, the vulnerable design resembles this:

BDC model
   ↓
TypeDescriptor
   ↓
TypeName
   ↓
.NET type resolution
   ↓
Object instantiation
   ↓
Potentially dangerous object behavior

The problem is not merely that an attacker can supply a strange type name.

The real security boundary failure occurs because SharePoint can turn attacker-controlled metadata into a sufficiently powerful .NET object graph.

Rapid7’s research demonstrated that this can be transformed into arbitrary code execution. (daily.dev)

Why Unsafe .NET Type Instantiation Is Dangerous

In a .NET application, dynamically resolving types is not inherently insecure.

Applications routinely use reflection mechanisms such as:

Type.GetType(typeName);

The security question is where typeName originates and what happens after the type is resolved.

Consider a system that accepts only three predefined types:

System.String
System.Int32
System.DateTime

The attack surface is relatively constrained.

Now imagine that instead of using an explicit allowlist, the application effectively accepts arbitrary types that happen to exist inside the application environment.

The difference is enormous.

An enterprise application such as SharePoint loads a large .NET ecosystem. Many assemblies and framework classes are available to the process. Individually, those classes may be completely legitimate.

But some can be combined into gadget chains.

A gadget is effectively a legitimate method, property, or class that becomes dangerous when an attacker can invoke it in an unintended sequence.

Instead of directly injecting machine code, the attacker abuses functionality that already exists on the server.

This is closely related to the broader security problems seen with unsafe deserialization and object graph construction.

CVE-2026-63520 therefore illustrates an important application-security principle:

Controlling the creation of arbitrary application types can be nearly as dangerous as controlling code itself.

The SharePoint Business Data Connectivity Attack Surface

Business Connectivity Services historically allow SharePoint to expose external business information inside familiar SharePoint interfaces.

For example, an organization might connect SharePoint to:

• CRM systems
• SQL databases
• ERP applications
• internal line-of-business services
• external APIs

BDC models describe how those resources should behave.

A simplified conceptual model might contain entities such as:

<Entity Name="Customer">
    <Identifier Name="CustomerId" />
    <Method Name="ReadCustomer">
        ...
    </Method>
</Entity>

Real BDC models are considerably more complex and can contain extensive type metadata.

CVE-2026-63520 becomes dangerous when that type metadata is interpreted in a way that lets a crafted model influence .NET type resolution.

Rapid7 reported that a malicious BDC model could ultimately be used to instantiate a dangerous object chain and reach operating-system command execution. Successful execution takes place with the permissions of the Windows service account responsible for the affected SharePoint site. (ノイズ)

That distinction is operationally important.

The immediate result is not necessarily システム.

But an attacker executing code as a SharePoint service identity has already crossed a major trust boundary and may gain access to SharePoint content, application configuration, credentials, network resources, or other systems reachable by that service account.

Understanding the CVE-2026-63520 Exploit Path

It is useful to think about exploitation in four conceptual phases rather than reducing the bug to “send request, get shell.”

Phase 1: Reach the BDC functionality

The attacker first needs a path into the SharePoint functionality that accepts or processes Business Data Connectivity metadata.

Phase 2: Introduce attacker-controlled type metadata

A specially constructed BDC model contains type definitions chosen to influence SharePoint’s .NET type-resolution logic.

Phase 3: SharePoint resolves an unsafe .NET type

The vulnerable component processes the supplied type information without sufficiently restricting the types that may be created.

Rapid7 identified the type-resolution behavior around DbTypeReflector.ResolveDotNetType() as central to the issue.

Phase 4: Object behavior reaches code execution

A suitable .NET gadget chain converts arbitrary type instantiation into a security-sensitive action.

Rapid7 demonstrated a chain involving ObjectDataProvider that could ultimately reach process execution.

The important defensive lesson is not the exact gadget.

It is that the vulnerable primitive is broader than a single gadget chain.

If the root weakness allows unsafe type construction, blocking one final class may not necessarily eliminate every possible exploitation technique.

That concern became especially relevant after other researchers demonstrated alternative approaches to exploiting the same underlying primitive. (daily.dev)

CVE-2026-63520 and CVE-2026-55040 Form a Much More Dangerous Chain

CVE-2026-63520 should not be assessed in isolation.

Rapid7’s original zero-day research discovered two vulnerabilities:

CVE-2026-55040
SharePoint JWT authentication bypass
             ↓
Attacker obtains SharePoint identity context
             ↓
CVE-2026-63520
Unsafe BDC .NET type instantiation
             ↓
Arbitrary code execution
             ↓
SharePoint server compromise

CVE-2026-55040 affects the SharePoint JWT validation pipeline.

The vulnerability allows an unauthenticated attacker to bypass authentication and impersonate a SharePoint user. Microsoft assigned CVE-2026-55040 a CVSS score of 9.1 Critical. (NVD)

That solves one of the practical problems an attacker faces when attempting to reach privileged SharePoint functionality.

The attacker no longer necessarily needs legitimate SharePoint credentials.

The authentication bypass supplies the required SharePoint identity context, while CVE-2026-63520 converts access to the vulnerable BDC functionality into code execution.

The result is much more serious:

Internet attacker
      ↓
No password
      ↓
SharePoint authentication bypass
      ↓
BDC manipulation
      ↓
Unsafe .NET object instantiation
      ↓
Remote code execution

Rapid7 explicitly describes the combination as an unauthenticated RCE exploit chain. (ノイズ)

Why the CVSS Score Can Be Misleading

Some administrators may see “8.1 High” and prioritize CVE-2026-63520 below a long list of CVSS 9.8 or 10.0 vulnerabilities.

That would be a mistake.

The CVSS vector is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Three fields deserve particular attention.

AV:N — Network Attack Vector

The vulnerable functionality can be reached over a network.

For externally accessible SharePoint installations, that can ultimately mean internet exposure.

PR:N — No Privileges Required

Microsoft’s CVSS assessment does not require existing privileges.

Rapid7’s concrete attack research is somewhat more nuanced because the demonstrated workflow interacts with SharePoint functionality that normally exists within an authenticated application context.

The companion CVE-2026-55040 authentication bypass solves that problem for a remote attacker.

This is a good example of why CVSS should not be interpreted as an exploit tutorial. The vector summarizes security characteristics; actual exploitation can involve application state and chained weaknesses.

AC:H — High Attack Complexity

This is the major factor reducing the base score.

The attacker needs to construct the appropriate SharePoint application state and a suitable .NET object chain.

But “High Complexity” does not mean “unlikely to be weaponized.”

Researchers have already demonstrated functional exploitation techniques, and VulnCheck reported developing an exploit for the combined CVE-2026-55040/CVE-2026-63520 chain. (VulnCheck Docs)

The discovery of a reliable exploit dramatically changes what “high complexity” means operationally.

Complexity is often expensive for the first researcher.

It is much less expensive for the thousandth attacker copying an established technique.

The Risk Increased After Technical Details Became Public

There are effectively several important dates for defenders.

July 14, 2026: Microsoft disclosed CVE-2026-55040 and released the corresponding SharePoint authentication-bypass fixes.

August 11, 2026: Microsoft and Rapid7 disclosed CVE-2026-63520 and Microsoft’s August SharePoint patches became available.

August 12–18: exploitation of CVE-2026-55040 was observed, eventually resulting in the vulnerability being added to CISA KEV on August 18. (NVD)

August 24: additional technical research explaining the CVE-2026-63520 RCE primitive became public. (mprove.de)

By August 25, independent researchers were also publicly reporting successful reproduction of the CVE-2026-63520 behavior. (CN-Sec)

As of the information available at the time of writing, this does ない mean CVE-2026-63520 itself has been confirmed as widely exploited in the wild.

That distinction matters.

There is a major difference between:

technical details available

and:

functional reproduction

and:

confirmed exploitation in real attacks

However, the first vulnerability needed to reach the chain, CVE-2026-55040, has already been confirmed exploited.

That is enough to justify urgent remediation.

Affected Microsoft SharePoint Versions

Microsoft lists the following versions as affected.

製品	Vulnerable versions	Fixed build threshold
SharePoint Enterprise Server 2016	Earlier builds	16.0.5565.1001
SharePoint Server 2019	Earlier builds	16.0.10417.20198
SharePoint Server Subscription Edition	Earlier builds	16.0.19725.20522

These version boundaries come from Microsoft’s CNA data published through the CVE record. (NVD)

Microsoft’s August security updates include:

SharePoint product	Relevant August 2026 update
SharePoint Server 2016	KB5002905 and associated components
SharePoint Server 2019	KB5002894 and associated language components
SharePoint Server Subscription Edition	KB5002893

Microsoft states that the SharePoint Server 2019 security package corresponds to build 16.0.10417.20198, while the Subscription Edition package corresponds to 16.0.19725.20522. (Microsoft Support)

Administrators should follow the exact Microsoft deployment instructions for their farm rather than treating a single KB as universally sufficient.

SharePoint farms frequently contain multiple servers, language packs, Workflow Manager integrations, and cumulative-update dependencies.

Why You Must Check the July Patch Too

Installing only the August CVE-2026-63520 update is not the strongest way to think about remediation.

The complete attack chain crosses two patch cycles.

You should confirm that both are addressed:

July 2026
CVE-2026-55040 authentication bypass
        +
August 2026
CVE-2026-63520 remote code execution

If July’s authentication bypass remains present, the server is already exposed to a vulnerability CISA has confirmed as actively exploited.

If August’s RCE vulnerability remains present as well, an attacker has the ingredients needed to potentially extend the authentication compromise into server-side code execution.

Defenders therefore should treat patch status as a chain, not simply as a collection of independent CVEs.

How to Check the SharePoint Farm Build

Administrators can inspect the farm version from the SharePoint Management Shell.

例えば、こうだ：

$farm = Get-SPFarm
$farm.BuildVersion

The resulting build should then be compared with Microsoft’s supported and patched build information for the exact SharePoint edition deployed.

Do not rely solely on:

• Windows Update history
• one web front end reporting success
• a single installed-program entry
• whether the server rebooted successfully

A SharePoint farm may contain multiple machines with inconsistent update states.

Inventory every relevant server role.

A useful defensive workflow is:

Enumerate SharePoint farm
        ↓
List every server
        ↓
Identify SharePoint edition
        ↓
Record build/version
        ↓
Verify July update
        ↓
Verify August update
        ↓
Confirm post-update configuration
        ↓
Run detection review

Detection Opportunities for CVE-2026-63520

Detection should combine application-layer and endpoint telemetry.

Searching only for a specific exploit HTTP request will age poorly because the underlying vulnerability can potentially support different gadget chains.

Searching only for suspicious processes will create excessive noise.

Correlation provides much higher confidence.

1. Monitor SharePoint IIS Worker Processes

SharePoint web applications typically execute inside IIS worker processes represented by:

w3wp.exe

Normal w3wp.exe behavior is extremely different from behavior such as:

w3wp.exe
   └── cmd.exe

or:

w3wp.exe
   └── powershell.exe

or:

w3wp.exe
   └── rundll32.exe

The presence of one of these relationships is not automatically proof of CVE-2026-63520 exploitation.

But on a SharePoint server it is an extremely strong hunting signal, particularly when correlated with unusual BDC activity.

Independent detection research has also highlighted abnormal children of w3wp.exe as one of the highest-value telemetry sources for this vulnerability family. (DevSecOpsDadAttack)

Microsoft Defender XDR Hunting Example

A simple starting query might look like:

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "cscript.exe",
    "wscript.exe"
)
| project
    Timestamp,
    DeviceName,
    AccountName,
    InitiatingProcessCommandLine,
    FileName,
    ProcessCommandLine,
    SHA1
| order by Timestamp desc

This is intentionally behavioral rather than exploit-specific.

Organizations should tune the rule against legitimate SharePoint administrative processes and deployment tooling.

2. Hunt for Unexpected Child Processes

More broadly, defenders should baseline everything that w3wp.exe normally launches.

Then investigate deviations.

Potentially suspicious examples include:

cmd.exe
powershell.exe
pwsh.exe
mshta.exe
rundll32.exe
regsvr32.exe
certutil.exe
bitsadmin.exe
curl.exe
cscript.exe
wscript.exe

Do not create a detection rule that assumes one specific binary will be used.

An attacker who has arbitrary code execution does not need to spawn コマンドエグゼ.

They might:

• load .NET code directly
• write a web shell
• access credentials
• use native Windows APIs
• create scheduled tasks
• modify SharePoint configuration
• connect to another internal system

Behavioral correlation is therefore essential.

3. Watch for Unexpected BDC Model Activity

Because CVE-2026-63520 involves Business Data Connectivity models, BDC administration itself becomes useful detection telemetry.

Organizations that rarely modify BDC models should treat unexpected imports or changes as high-signal events.

Ask:

Who modified BDC metadata?
When?
From what IP address?
Was the account expected?
Was a maintenance change scheduled?
What happened on the server immediately afterward?

A BDC modification followed seconds later by a suspicious child process from w3wp.exe deserves immediate investigation.

4. Monitor Outbound Connections from SharePoint

Post-exploitation activity frequently requires the compromised server to communicate with another system.

Monitor unexpected outbound network connections initiated by processes associated with the SharePoint application pool.

Particularly investigate combinations such as:

w3wp.exe
     ↓
unusual external destination

or:

w3wp.exe
     ↓
command interpreter
     ↓
external connection

Outbound access controls are especially valuable for internet-facing enterprise applications because they can limit what an attacker can do after obtaining RCE.

5. Look for Service Account Abuse

Rapid7 reports that successful code execution occurs with the permissions of the Windows service account associated with the SharePoint site. (ノイズ)

That creates another hunting opportunity.

Review whether SharePoint service identities suddenly:

• authenticate to unusual hosts
• access administrative shares
• query Active Directory unusually
• access secrets
• launch remote-management tools
• read large quantities of SharePoint data
• establish network sessions outside their normal baseline

In many real compromises, the initial exploit is only seconds long.

Identity misuse can continue for hours or days.

What CVE-2026-63520 Could Allow an Attacker to Do

Successful RCE should be treated as application-server compromise.

Depending on service-account privileges, network architecture, credentials available to the host, and SharePoint configuration, follow-on consequences could include:

SharePoint Data Theft

SharePoint commonly stores:

• internal documents
• 契約
• engineering files
• financial information
• employee records
• customer data
• operational procedures

A compromised SharePoint application server can become a high-value collection point.

Credential Access

An attacker may attempt to recover:

• service-account credentials
• application secrets
• connection strings
• certificates
• tokens
• cached credentials

永続性

Possible persistence mechanisms include web-layer modifications, scheduled tasks, services, startup mechanisms, or abuse of existing SharePoint functionality.

横の動き

Because SharePoint normally communicates with databases, Active Directory, file servers, and other internal applications, compromising SharePoint can provide a valuable internal pivot.

Availability Impact

The CVSS score assigns High availability impact.

An attacker with code execution may be able to disrupt the SharePoint application, damage configuration, modify files, or interfere with services.

Is Microsoft SharePoint Online Affected?

The published CVE focuses on the server products managed by customers, including:

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Organizations should therefore distinguish on-premises SharePoint Server from Microsoft’s SaaS-hosted SharePoint Online environment.

Do not assume that a Microsoft 365 SharePoint Online tenant is affected simply because the product shares the SharePoint name.

The remediation discussed here primarily concerns customer-managed SharePoint Server infrastructure identified in Microsoft’s affected-product list. (NVD)

Why Internet-Facing SharePoint Servers Deserve Priority

SharePoint represents an unusually attractive attack surface because it combines three properties:

Internet accessibility
+
Sensitive enterprise data
+
Deep internal integration

Many enterprise applications possess one or two of those characteristics.

SharePoint often possesses all three.

A compromised marketing website may expose public content.

A compromised SharePoint farm can expose internal documents while simultaneously giving the attacker access to a Windows server closely integrated with the rest of the enterprise.

That is why vulnerabilities that move from SharePoint authentication into operating-system code execution consistently deserve aggressive remediation.

Patching CVE-2026-63520

Microsoft released security fixes on August 11, 2026.

SharePoint Server Subscription Edition administrators should review KB5002893. Microsoft states that the update resolves multiple security vulnerabilities including CVE-2026-63520 and corresponds to build 16.0.19725.20522. (Microsoft Support)

SharePoint Server 2019 administrators should review KB5002894, which corresponds to build 16.0.10417.20198. (Microsoft Support)

SharePoint 2016 deployments are covered by Microsoft’s corresponding August SharePoint Server 2016 security update family. Microsoft Patch Tuesday information maps CVE-2026-63520 to KB5002905 and associated SharePoint components.

Before deployment, check Microsoft’s prerequisites carefully.

For example, Microsoft warns customers using SharePoint Workflow Manager that specific Workflow Manager updates may need to be installed before the cumulative SharePoint update. (Microsoft Support)

If You Cannot Patch Immediately

Microsoft did not publish a general official workaround that should be treated as equivalent to installing the security update.

Therefore compensating controls should be understood as risk reduction, not remediation.

The most effective temporary approach is to reduce attacker reachability.

Organizations can consider:

Internet
   X
Firewall / VPN / authenticated access gateway
   ↓
SharePoint

Where operationally possible:

• remove unnecessary public exposure
• allowlist trusted networks
• require VPN access
• segment SharePoint servers
• tightly restrict outbound connectivity
• monitor BDC administrative activity
• increase endpoint telemetry
• review application-pool service-account privileges

An unpatched internet-facing SharePoint instance should be treated substantially differently from an internal instance accessible only from tightly controlled management networks.

Incident Response Guidance

If suspicious activity is identified, do not stop at patching.

A patch prevents future exploitation.

It does not remove an attacker who has already compromised the system.

Investigators should review at least:

IIS logs
SharePoint ULS logs
Windows Security logs
PowerShell logs
EDR process telemetry
network telemetry
SharePoint audit records
service-account authentication events
file creation events
scheduled tasks
services
persistence mechanisms

Pay particular attention to the period surrounding unusual SharePoint application activity.

A useful correlation model is:

Suspicious SharePoint request
        ↓
BDC-related modification
        ↓
w3wp.exe behavior change
        ↓
new child process
        ↓
file or registry modification
        ↓
outbound network activity

Any chain resembling that sequence should be investigated as a potential server compromise rather than simply a failed web attack.

CVE-2026-63520 Versus Earlier SharePoint RCE Vulnerabilities

One reason SharePoint vulnerabilities repeatedly become major defensive events is architectural complexity.

SharePoint is not simply an HTTP application.

It sits on top of:

• アイアイエス
• ASP.NET
• the .NET Framework
• Windows authentication
• Active Directory
• SQL Server
• service applications
• extensibility frameworks
• workflow systems
• custom application integrations

Every boundary between those components creates potential security assumptions.

CVE-2026-63520 is an especially useful example.

The vulnerability does not originate from a traditional memory corruption flaw.

There is no requirement for a classic buffer overflow.

Instead, legitimate application functionality becomes dangerous because untrusted metadata is allowed too much influence over the runtime type system.

That pattern is increasingly important in modern security research.

Why Gadget-Based Vulnerabilities Are Difficult to Fix Correctly

Security teams frequently make the mistake of focusing on the final gadget rather than the primitive enabling it.

Suppose a vulnerability works because:

attacker controls arbitrary .NET type

and the exploit happens to use:

Type A → Type B → dangerous method

Blocking Type A may stop the published exploit.

But if the attacker still controls arbitrary type creation, there may be:

Type C → Type D → another dangerous method

The correct security boundary is generally closer to:

Only explicitly approved types may be instantiated.

rather than:

Block the known bad type.

The fact that different researchers have explored different exploitation paths around CVE-2026-63520 reinforces this point. (daily.dev)

AI-Assisted Vulnerability Research Is Part of This Story

CVE-2026-63520 is notable for another reason.

Rapid7 described the SharePoint research project as heavily assisted by AI-driven security research workflows.

The researchers did not simply ask a language model to “find SharePoint vulnerabilities.”

Instead, the project combined:

• agentic tooling
• reverse engineering
• source-code analysis
• architectural mapping
• manual researcher guidance
• repeated validation

Rapid7 reported that its first research sprint did not produce a significant vulnerability.

After improving both the underlying model and the surrounding workflow, researchers discovered CVE-2026-55040 and then CVE-2026-63520.

The broader lesson is important.

AI does not eliminate the need for expert security research.

It changes the economics of exploring enormous proprietary attack surfaces.

SharePoint contains enough code, configuration paths, .NET assemblies, service applications, and authentication logic that exhaustive manual analysis is extremely expensive.

Agentic systems can investigate substantially more hypotheses than a human researcher could manually explore, while experienced humans reject false positives and steer the process toward promising attack surfaces. Rapid7 reported approximately 80,000 agentic tool calls during the research effort. (ノイズ)

That matters to defenders because the traditional assumption that obscure enterprise code paths will remain undiscovered for years is becoming less reliable.

CVE-2026-63520 Exploitation Status

There are several different signals worth separating.

Microsoft rated exploitation of CVE-2026-63520 as more likely in August Patch Tuesday reporting. (Tenable®)

CISA’s initial SSVC enrichment for CVE-2026-63520 did not record active exploitation. (NVD)

Researchers have developed functional exploit chains, and additional technical information became publicly available in late August. (VulnCheck Docs)

The related CVE-2026-55040 authentication bypass, however, is already actively exploited and present in CISA KEV. (NVD)

Therefore the correct conclusion is not:

CVE-2026-63520 is definitely being mass exploited.

Nor is it:

There is no risk because exploitation has not been confirmed.

The more accurate position is:

The RCE technique is understood and reproducible, its authentication-bypass companion is already being exploited, and the remediation window for unpatched SharePoint servers should be considered effectively closed.

Recommended Remediation Priority

For defenders, the practical priority is straightforward.

Priority 1: Internet-Facing SharePoint

Patch immediately.

Verify both July and August SharePoint security updates.

Priority 2: Verify CVE-2026-55040 Remediation

Because CVE-2026-55040 is actively exploited, failing to patch the authentication bypass leaves a known initial-access vector available to attackers.

Priority 3: Verify CVE-2026-63520 Remediation

Confirm SharePoint farm builds meet Microsoft’s patched build requirements.

Priority 4: Hunt for Prior Compromise

Patching without investigation may miss compromises that occurred before remediation.

Priority 5: Reduce Exposure

Consider whether the SharePoint service genuinely needs direct internet accessibility.

よくあるご質問

What is CVE-2026-63520?

CVE-2026-63520 is a high-severity Microsoft SharePoint Server remote code execution vulnerability associated with unsafe handling of attacker-influenced .NET type information in Business Data Connectivity functionality.

What is the CVSS score for CVE-2026-63520?

Microsoft assigned CVE-2026-63520 a CVSS v3.1 score of 8.1 High with the vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD)

Can CVE-2026-63520 be exploited remotely?

Yes. Microsoft classifies the attack vector as network-based.

Does exploitation require user interaction?

No. The CVSS vector specifies UI:N.

Does CVE-2026-63520 allow remote code execution?

Yes. Successful exploitation can result in arbitrary code executing with the privileges of the Windows service account running the affected SharePoint site. (ノイズ)

How does CVE-2026-63520 work?

The vulnerability involves unsafe .NET type resolution and instantiation inside SharePoint’s Business Data Connectivity functionality. Crafted BDC metadata can influence which .NET types SharePoint resolves, allowing attackers to construct dangerous object behavior that can ultimately reach code execution. (daily.dev)

What is the relationship between CVE-2026-63520 and CVE-2026-55040?

CVE-2026-55040 is a SharePoint JWT authentication bypass. When combined with CVE-2026-63520, it can provide an unauthenticated path to remote code execution.

Is CVE-2026-55040 actively exploited?

Yes. CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog on August 18, 2026. (NVD)

Is CVE-2026-63520 actively exploited?

Public research and functional exploitation techniques exist, but the available authoritative CVE data does not currently establish CVE-2026-63520 itself as a CISA KEV vulnerability. Defenders should distinguish functional exploit availability from confirmed widespread exploitation.

Which SharePoint versions are affected?

Microsoft identifies SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition as affected. (NVD)

Is there a patch for CVE-2026-63520?

Yes. Microsoft released security updates on August 11, 2026.

Should organizations patch CVE-2026-55040 too?

Absolutely. Organizations should verify both the July authentication-bypass fix and the August RCE fix because the vulnerabilities can be chained.

Final Assessment

CVE-2026-63520 is more than another entry in Microsoft’s August 2026 Patch Tuesday list.

It exposes a particularly dangerous boundary inside Microsoft SharePoint: attacker-controlled application metadata can influence .NET object construction deeply enough to reach arbitrary code execution.

On its own, Microsoft rates the vulnerability 8.1 High.

In the context of the broader SharePoint attack surface, the risk is significantly greater.

Rapid7 demonstrated that CVE-2026-63520 can be paired with the critical CVE-2026-55040 SharePoint authentication bypass to create an end-to-end path from a remote unauthenticated attacker to code execution on the SharePoint server. The authentication bypass has already moved from research into real-world exploitation and was added to CISA’s Known Exploited Vulnerabilities catalog on August 18. (NVD)

At the same time, detailed research into CVE-2026-63520 is now public, multiple researchers have developed functional exploitation techniques, and Microsoft’s own exploitability assessment describes exploitation as more likely. (VulnCheck Docs)

For defenders, the response should therefore not depend on whether CVE-2026-63520 itself appears in KEV tomorrow.

The important question is whether an attacker already has enough information to turn an unpatched SharePoint farm into a realistic target.

The answer is increasingly yes.

Organizations running on-premises SharePoint should verify the July 2026 CVE-2026-55040 patches, deploy the August 2026 CVE-2026-63520 updates, confirm patched build numbers across every node in the farm, and hunt for suspicious activity involving BDC metadata, abnormal w3wp.exe child processes, unexpected SharePoint service-account behavior, and unexplained outbound connections.

For internet-facing SharePoint infrastructure, CVE-2026-63520 should be treated as an urgent remediation issue rather than a routine CVSS 8.1 patch.