Summary
CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint caused by improper input validation (CWE-20) in the Business Connectivity Services component, where an unsafe .NET type instantiation can be triggered by attacker-supplied input. The flaw affects on-premises SharePoint Server deployments and carries a CVSS v3.1 base score of 8.1 (High). It has been publicly linked to a chain with a separate SharePoint authentication-bypass flaw (CVE-2026-55040), which together can enable unauthenticated remote code execution.
Technical details
- Root cause: Improper input validation allows an unsafe .NET type to be instantiated from attacker-controlled input within SharePoint’s Business Connectivity Services.
- Trigger conditions: A specially crafted network request submitted to a vulnerable SharePoint server; on its own the flaw requires some level of access, but it can be combined with an authentication-bypass vulnerability disclosed alongside it to remove that requirement.
- Attack vector: Network (AV:N), high attack complexity (AC:H), no privileges/user interaction required per the published vector.
- Impact: Arbitrary code execution on the SharePoint server, running with the privileges of the SharePoint site’s service account; confidentiality, integrity, and availability impacts are all rated High.
Affected software
- Microsoft SharePoint Enterprise Server 2016 — versions before 16.0.5565.1001
- Microsoft SharePoint Server 2019 — versions before 16.0.10417.20198
- Microsoft SharePoint Server Subscription Edition — versions before 16.0.19725.20522
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Apply the Microsoft security update that brings SharePoint Enterprise Server 2016 to 16.0.5565.1001 or later, SharePoint Server 2019 to 16.0.10417.20198 or later, or SharePoint Server Subscription Edition to 16.0.19725.20522 or later.
- If no patch is available: Restrict inbound network access to SharePoint servers to trusted networks, monitor for exploitation attempts and unusual Business Connectivity Services activity, and prioritize patching given the potential for chaining with authentication-bypass vulnerabilities affecting the same product.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Named response headers:
MicrosoftSharePointTeamServices,SPRequestGuid,SharePointHealthScore,X-SharePointHealthScore - Meta tag content (
generator):Microsoft SharePoint - JavaScript objects present after the page renders:
SPDesignerProgID,_spBodyOnLoadCalled