A newly disclosed vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-63520, could allow attackers to execute arbitrary code remotely on affected systems.
This flaw has a severity rating of 8.1 out of 10 according to CVSS v3.1. It affects supported versions of Microsoft SharePoint, as well as certain deployments of Microsoft Project Server and Microsoft Office Web Apps Server.
Microsoft SharePoint RCE Vulnerability
Rapid7 Labs discovered the issue during zero-day research focused on SharePoint’s extensive attack surface in enterprise environments.
The vulnerability arises from improper input validation in SharePoint’s Business Connectivity Services (BCS), which allows for unsafe .NET type instantiation. By supplying specially crafted data, an attacker may trigger a malicious .NET gadget chain, thereby executing commands on a vulnerable server.
The executed code runs with the privileges assigned to the Windows service account that operates the affected SharePoint Site instance.
Therefore, the practical impact of this vulnerability will depend on how that account is configured, its permissions, and the server’s access to internal resources.
In environments where SharePoint service accounts have extensive privileges or can access sensitive document repositories, Active Directory resources, or connected infrastructure, successful exploitation could provide attackers with a significant foothold.
Microsoft has classified CVE-2026-63520 as “Important.” The CVSS vector indicates that it is network-accessible, requires no privileges or user interaction, and has a high potential impact on confidentiality, integrity, and availability.
However, the vulnerability has a high attack-complexity requirement when considered independently.
The risk escalates when CVE-2026-63520 is combined with CVE-2026-55040, a previously disclosed authentication-bypass vulnerability affecting SharePoint JWT tokens.
This authentication flaw may eliminate initial access barriers. At the same time, the newly patched remote code execution vulnerability allows for arbitrary command execution.
Together, these vulnerabilities create an unauthenticated remote code execution (RCE) chain against exposed, unpatched SharePoint servers.
Rapid7 researcher Stephen Fewer identified both issues during a project initially developed for Pwn2Own Berlin 2026. The research utilized a combination of manual source code review, reverse engineering, and guided AI workflows.
The team reported that this project ultimately produced a working exploit chain after 120 hours of AI runtime over 24 days, 96 sessions, approximately 80,000 tool calls, and 256 prompts.
Although the Pwn2Own entry was not successfully demonstrated during the competition, the research highlights how AI-assisted workflows can expedite the discovery of vulnerabilities in complex enterprise software.
Rapid7 emphasized that oversight by subject-matter experts remains crucial for validating findings, guiding investigations, and identifying inaccuracies in model-generated results.
Administrators should prioritize applying Microsoft’s security updates for CVE-2026-63520 and assess whether instances of SharePoint, Project Server, or Office Web Apps Server are accessible from the internet.
Organizations should also review the permissions of SharePoint service accounts, monitor for unusual SharePoint process activity, investigate unexpected command executions, and isolate exposed systems until patches are deployed.
Rapid7 plans to publish detailed technical information within 30 days of disclosure. In the meantime, defenders should treat this vulnerability chain as a high-priority issue for patching and exposure management, especially for organizations that rely on on-premises SharePoint infrastructure.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
