A recently identified vulnerability in Microsoft SharePoint Server is raising alarms throughout IT departments as security experts warn about its potential to allow remote execution of malicious code without authentication.
Known as CVE-2026-63520, this flaw was discovered by Rapid7 Labs during a focused zero-day research project and has been publicly disclosed in collaboration with Microsoft.
Understanding the Exploit Chain
The vulnerability is part of a two-stage exploit chain, with the first component, CVE-2026-55040, revealed the previous month. When these vulnerabilities are combined, they enable remote code execution (RCE) on vulnerable SharePoint servers without authentication.
Research conducted by Rapid7 indicates that CVE-2026-63520 impacts all supported versions of Microsoft SharePoint, as well as certain versions of Microsoft Project Server and Microsoft Office Web Apps Server. However, the primary testing was conducted on SharePoint deployments.
Technical Details of the Vulnerability
The flaw stems from an unsafe .NET type instantiation issue found in SharePoint’s Business Connectivity Services, which facilitates interaction with external data sources. This weakness allows attackers to execute arbitrary code using the privileges of the SharePoint Site’s service account, gaining unauthorized access to an organization’s internal systems.
Microsoft’s summary highlights inadequate input validation in Office SharePoint as the core issue, making it possible for unauthorized code execution over networks.
This poses significant risks, especially for organizations with internet-facing or poorly segmented SharePoint servers, potentially exposing sensitive data and connected enterprise applications to attackers.
Mitigation and Recommendations
As of the disclosure, there have been no public exploits or proof-of-concept codes, though Microsoft rates the exploitability as “more likely,” suggesting a high potential for attackers to take advantage soon.
While the CVSS score denotes a high attack complexity, requiring precise conditions and substantial effort to exploit, organizations are strongly advised to apply all relevant security updates immediately.
Administrators should ensure all applicable patches are installed, as updates can be applied in any order but must be comprehensive to provide full protection. This is particularly crucial for those managing SharePoint Server 2016 and SharePoint Enterprise Server 2016, which share patch requirements.
In light of the recent vulnerabilities, security teams should prioritize SharePoint patch management and continuously audit deployments to prevent potential future exploits.
Researcher Stephen Fewer from Rapid7, who discovered the vulnerability, stresses the importance of analyzing chained vulnerabilities to uncover deeper structural weaknesses in enterprise platforms.
Organizations are encouraged to review their SharePoint systems, confirm patch levels, and monitor for unusual activity in the Business Connectivity Services as a preventive measure.
