CVE-2026-635208.1HighCWE-20
CVE-2026-63520: Microsoft SharePoint Enterprise Server 2016 vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
Vendor fix available · Affected: Microsoft SharePoint Enterprise Server 2016 · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub26 Aug
- Not established: not seen
1.0%probability of exploitation in the next 30 days
61st percentile
050100
Higher than 61% of scored CVEs
8.1HighCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage5 articles · 3 outlets
One row per outlet, in order of first report. First in our coverage: Rapid7, 11 Aug.
Quiet for 11 weekslast report 25 Aug5 articles3 outlets
- Tue 11 Aug, 14:51 UTC. Rapid7, first report. Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass.
- Wed 12 Aug, 00:47 UTC. Rapid7. Microsoft Fixes 421 Flaws Including SharePoint Zero Day.
- Wed 12 Aug, 15:21 UTC. SecurityWeek, its first report on the story. SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack.
- Tue 25 Aug, 00:11 UTC. Rapid7. Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).
- Tue 25 Aug, 15:50 UTC. SecurityOnline, its first report on the story. Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 11 Aug 14:51 | Rapid7 | Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass |
| 12 Aug 00:47 | Rapid7 | Microsoft Fixes 421 Flaws Including SharePoint Zero Day |
| 12 Aug 15:21 | SecurityWeek | SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack |
| 25 Aug 00:11 | Rapid7 | Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) |
| 25 Aug 15:50 | SecurityOnline | Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited |
- SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active AttackSecurityWeek · mentions it in passing
- Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth BypassRapid7 · first in our coverage
New articles also arrive in the RSS feed.