🟠 High | Source: Microsoft Security Response Center
A remote code execution vulnerability in Microsoft SharePoint Server allows an authenticated attacker to run arbitrary code over the network by exploiting unsafe handling of untrusted data during deserialization. Because SharePoint is widely used for collaboration and document management, successful exploitation could give an attacker significant control over affected systems and potentially the wider network. The requirement for prior authorisation limits opportunistic attacks but does not remove the risk, particularly in environments with broad user access.
Security Architect’s Take: Prioritise patching all SharePoint Server instances immediately and, in the interim, review network segmentation to limit lateral movement potential from SharePoint hosts. Also audit which accounts have authorised access to SharePoint to reduce the pool of potential attackers who could exploit this vulnerability.
Original advisory: CVE-2026-63514 Microsoft SharePoint Server Remote Code Execution Vulnerability