CVE-2026-63520: Microsoft SharePoint Server Remote Code Execution Vulnerability

What it is

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Description quoted from the CVE record (assigned by microsoft, published 2026-08-11).

Weakness: CWE-20: Improper Input Validation

How it can be exploited

Exploitable over the network with high attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 4 code repositories and 1 research write-up naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 9 references on Exploit Observer

Live scores

EPSS

0.010
low predicted chance of attack

VEDAS

0.988
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 16.0.5565.1001, 16.0.10417.20198, 16.0.19725.20522.

Vendor guidance:

• Microsoft SharePoint Server Remote Code Execution Vulnerability (vendor-advisory, patch)

How to detect it

Suricata rules (network detection)

2 rules that alert on traffic matching this exploit: VEDAS CVE-2026-63520 Microsoft SharePoint Malicious BDC Model (.bdcm) Upload with Deserialization Gadget. Add them to your Suricata rule set and reload.

# CVE-2026-63520 - Microsoft SharePoint Business Connectivity Services (BDC) deserialization RCE.
# Exploit path (Rapid7/VulnCheck/s2w): upload a malicious BusinessDataMetadataCatalog/*.bdcm model
# defining a LobSystem that instantiates System.Web.UI.LosFormatter (deserialization gadget), then
# trigger it via a CSOM Action to /_vti_bin/client.svc/ProcessQuery. Offline detection of both steps.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-63520 Microsoft SharePoint Malicious BDC Model (.bdcm) Upload with Deserialization Gadget"; flow:established,to_server; http.uri; content:"BusinessDataMetadataCatalog"; nocase; fast_pattern; content:".bdcm"; nocase; http.request_body; pcre:"/(?:System\.Web\.UI\.LosFormatter|ObjectDataProvider|ExpandedWrapperOf|<LobSystem[\s>])/i"; classtype:attempted-admin; reference:cve,CVE-2026-63520; reference:url,https://www.exploit.observer/?keyword=CVE-2026-63520&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=sharepoint&match=exact; sid:1088401; rev:1;)
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-63520 Microsoft SharePoint BDC Deserialization Trigger via ProcessQuery"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/_vti_bin/client.svc/ProcessQuery"; nocase; fast_pattern; http.request_body; content:"BusinessData"; nocase; pcre:"/Microsoft\.SharePoint\.BusinessData|LobSystemInstance|EntityInstance/i"; classtype:attempted-admin; reference:cve,CVE-2026-63520; reference:url,https://www.exploit.observer/?keyword=CVE-2026-63520&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=sharepoint&match=exact; sid:1088402; rev:1;)

CVE-2026-63520.rules on GitHub

References

Vendor advisories and patches

• Microsoft SharePoint Server Remote Code Execution Vulnerability (vendor-advisory, patch)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.