Main Vulnerability Database Vulnerabilities #VU141466

Input validation error in Microsoft products - CVE-2026-63520

Published: August 11, 2026

Vulnerability identifier: #VU141466

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63520

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SharePoint Server. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.

Affected software

Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft SharePoint Server Subscription Edition

How to mitigate CVE-2026-63520

Install updates from vendor's website.

Microsoft SharePoint Enterprise Server - update to 16.0.5565.1001
Microsoft SharePoint Server - update to 16.0.10417.20198
Microsoft SharePoint Server Subscription Edition - update to 16.0.19725.20522

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520

Related Security Bulletins