🟠 High | Source: Microsoft Security Response Center
A spoofing vulnerability in Microsoft SharePoint Server allows an authenticated attacker to exploit unsafe deserialisation of untrusted data over a network, potentially impersonating other users or systems. Deserialisation flaws are particularly dangerous as they can be chained with other weaknesses to escalate impact. Although the attacker must already be authorised, the network-based attack vector lowers the bar for exploitation in environments with broad internal access.
Security Architect’s Take: Prioritise applying Microsoft’s patch for this vulnerability through your standard patching pipeline, accelerating timelines for any SharePoint instances exposed to internal networks with large user populations. In the interim, review and restrict network access to SharePoint Server using perimeter controls and ensure audit logging is enabled to detect anomalous authentication or identity-switching activity.
Original advisory: CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability