Skip to content
OriginalSign in
Image: Rapid7

Rapid7Adam Barnett

Microsoft Fixes 421 Flaws Including SharePoint Zero Day

Part of the CVE-2026-63520 story · since 11 Aug

Quiet for 11 weekslast report 25 Aug5 articles3 outlets
11 Aug · Rapid7 first12 Sep28 Sep14 OctNowThis article2nd of 5
  • Tue 11 Aug, 14:51 UTC. Rapid7, first report. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass.
  • Wed 12 Aug, 00:47 UTC. Rapid7. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. This article, 2nd of 5.
  • Wed 12 Aug, 15:21 UTC. SecurityWeek, its first report on the story. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack.
  • Tue 25 Aug, 00:11 UTC. Rapid7. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).
  • Tue 25 Aug, 15:50 UTC. SecurityOnline, its first report on the story. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited.

On August 11, 2026, Microsoft released updates addressing 421 vulnerabilities, with 236 affecting Windows, marking a significant Patch Tuesday. Notable vulnerabilities include:

1. **CVE-2026-63520**: Critical remote code execution vulnerability in Microsoft SharePoint.

2. **CVE-2026-68820**: An exploited zero-day affecting Windows Ancillary Function Driver for WinSock, allowing elevation of privileges.

3. **CVE-2026-62832**: Elevation of privilege vulnerability in Windows User Profile Service, publicly disclosed but no known exploit yet.

4. **CVE-2026-72971**: Tampering vulnerability in Windows Container Isolation FS Filter Driver, disclosed publicly.

There was an unusual absence of security patches for Microsoft Edge, and lifecycle updates for various Microsoft products were also noted, with several products reaching end of support soon.

How the story developed

All 5 articles
Quiet for 11 weekslast report 25 Aug5 articles3 outlets

5 articles from 3 outlets since 11 Aug. Quiet since 25 Aug. This was the 2nd report, 10 hours after the first.

Now11 Aug14161820222426First reportRapid7 · 11 Aug, 14:51Picked up againafter 12 days quiet
  • Tue 11 Aug, 14:51 UTC. Rapid7, first report. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass.
  • Wed 12 Aug, 00:47 UTC. Rapid7. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. This article, 2nd of 5.
  • Wed 12 Aug, 15:21 UTC. SecurityWeek, its first report on the story. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack.
  • Tue 25 Aug, 00:11 UTC. Rapid7. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).
  • Tue 25 Aug, 15:50 UTC. SecurityOnline, its first report on the story. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Tue 11 AugDay 01
    1. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass14:51 · Rapid7 · First report
  2. Wed 12 AugDay 12
    1. Microsoft Fixes 421 Flaws Including SharePoint Zero Day00:47 · Rapid7 · This article, 2nd of 5
    2. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack15:21 · SecurityWeek

  3. Quiet for 12 days

    Tue 25 AugDay 142
    1. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)00:11 · Rapid7 · Picked up again
    2. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited15:50 · SecurityOnline

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in