KEV Intelligence is becoming Previdian.

Vulnerability report

Active exploitation observed Confirmed confidence Not in CISA KEV

CVE-2026-63520

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft / Microsoft SharePoint Enterprise Server 2016 · affected before 16.0.5565.1001

View live feed Monitor via API Watch CVE
Severity
CVSS 8.1 · High
Confidence
Confirmed
Exploit status
Observed in sensors
EPSS
2.9%
First observed
25 Aug 2026
Last observed
30 Aug 2026

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-63520 is an unauthenticated Microsoft SharePoint Server Remote Code Execution Vulnerability. Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence. Also confirmed by third-party sources.

Who is affected?

Microsoft / Microsoft SharePoint Enterprise Server 2016 affected before 16.0.5565.1001.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Vendor Product Affected Status
Microsoft Microsoft SharePoint Enterprise Server 2016 Before 16.0.5565.1001 Affected
Microsoft Microsoft SharePoint Server 2019 Before 16.0.10417.20198 Affected
Microsoft Microsoft SharePoint Server Subscription Edition Before 16.0.19725.20522 Affected
View vendor advisory (opens in new tab)
Published
11 Aug 2026
Exploitation Reported
25 Aug 2026
Attack vector
Remote
Complexity
High
Privileges
None
User interaction
None

Tags

microsoft

CVE References

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Defused Cyber

Recorded 25 Aug 2026

Independent exploitation attestation added to the Previdian record.

Active exploitation observed

Previdian sensor

First observed 25 Aug 2026

First-party sensor telemetry confirms matching exploitation attempts.

Proof of concept available

GitHub

Recorded 26 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Defused Cyber First 2026-08-25 10:53 UTC
Previdian 2026-08-29 21:59 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Aggregate observations show the scale, recency, and distribution of activity without overstating sparse data.

76

Attempts observed

12

Unique attacker IPs

8

Attacker countries

FR · HK · ID · NL · RO · SA · SG · US

1

Sensors observed

Exploitation attempts over the last 9 days

Daily events observed by Previdian sensors

Updated 01 Sep 2026

0
13
32
18
0
7
6
0
0
24 Aug 26 Aug 28 Aug 30 Aug 1 Sep

First observed 25 Aug 2026 · Last observed 30 Aug 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Request telemetry access

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
15
User-Agents
4

Raw values available in Pro and Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

2.9%

Weaknesses

Improper Input Validation CWE-20

Recent mention · Rapid7

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Read full advisory

All Mentions

Recent mention · Rapid7

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 · 24 Aug 2026

Recent mention · Rapid7

Patch Tuesday - August 2026

Rapid7 · 11 Aug 2026

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for one of the vulnerabilities published today, as well as public disclosure for two others, although the Notable CVEs section of the Security Update Guide omits one of these. As usual, browser vulns are...

Recent mention · Tenable Blog

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)

Tenable Blog · 11 Aug 2026

42Critical355Important1Moderate0LowMicrosoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild.Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.This month’s update includes patches for:.NET.NET Core.NET FrameworkAMD ZenActive Directory Certificate Services (AD CS)Application Information ServicesAzure Active DirectoryAzure CycleCloudAzure Monitor...

Recent mention · Tenable Blog

Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)

Tenable Blog · 11 Aug 2026

42Critical355Important1Moderate0LowMicrosoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild.Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.This month’s update includes patches for:.NET.NET Core.NET FrameworkAMD ZenActive Directory Certificate Services (AD CS)Application Information ServicesAzure Active DirectoryAzure CycleCloudAzure Monitor...

Recent mention · Rapid7

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 · 11 Aug 2026

OverviewRapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first vulnerability in the chain, CVE-2026-55040, was disclosed by Rapid7 and Microsoft last month.Our full disclosure timeline for the exploit chain can be seen below in Figure 1.Figure 1: The road to...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

hypnguyen1209/CVE-2026-63520

github · Created 2026-08-26 16:54:04 UTC · 0 stars · AI assessment 90%

POC pre-auth RCE on Sharepoint chain

Timeline

From disclosure to observed exploitation

  1. Public PoC available

    Public proof-of-concept code published

  2. Observed by Previdian sensors

    Evidence-backed exploitation signal

  3. Indicators of compromise added (12)

    Indicators of compromise recorded

  4. Added to Previdian KEV Feed

    High-confidence, third-party attested exploitation

  5. CVE published

    Vulnerability disclosed publicly

  6. CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-63520

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2026-63520",
  "confidence": "Confirmed",
  "cvss_score": 8.1,
  "cvss_estimated": false,
  "epss_score": 0.02893,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 76, "sensors": 1 }
}