CVE-2026-63512

This vulnerability is like giving someone a small office key but accidentally letting them access rooms they weren’t supposed to. In this case, a logged-in user with limited permissions may be able to alter or corrupt data inside your SharePoint environment over the network. If that happens, it can lead to changed files or content that doesn’t reflect what your business intended.

This matters if you run Microsoft SharePoint Server 2016, 2019, or the SharePoint Server Subscription Edition, because the flaw is in SharePoint’s authorization handling. It mainly becomes a risk when an attacker already has valid credentials (even low-privileged ones), since the vulnerability requires authentication.
The practical gate is: a risk only if an attacker can log in to SharePoint with low-level permissions.

This is RED because the issue enables tampering by an authenticated low-privilege user, which can quickly turn into real business impact if credentials are abused. Also, security attention is high enough to have been actively associated with the Lazarus group in this patch cycle, and the fix is available for all affected SharePoint lines.

1. Confirm exposure in your environment

• Identify which exact SharePoint product you use (SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition, or SharePoint Server).
• Determine your current SharePoint build number.
• Decide whether you are affected by checking whether your build is earlier than the fixed versions:
  • SharePoint Server and SharePoint Server Subscription Edition: fixed in 16.0.19725.20522
  • SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
  • SharePoint Server 2019: fixed in 16.0.10417.20198

2. Patch / upgrade

• Apply the official Microsoft update for CVE-2026-63512 from Microsoft’s update guide.
• Upgrade to at least the fixed build for your specific SharePoint product line (listed above).
• Plan for normal SharePoint update procedure in your maintenance window.

3. Validate after patching

• Re-check the SharePoint build number to confirm it matches or exceeds the fixed version for your product.
• Review SharePoint audit/activity logs for suspicious tampering patterns, such as:
  • unexpected edits to documents/lists/sites,
  • changes performed by accounts that usually have limited roles,
  • repeated permission-like actions followed by content changes.

4. If you cannot patch immediately

• Reduce the chance that an attacker has valid SharePoint credentials by tightening account security (password resets for at-risk users, enforce MFA where applicable, and promptly disable stale accounts).
• Recheck role assignments for low-privilege users and ensure they only have the minimum permissions needed.
• Increase monitoring of SharePoint change events and investigate anything out of the ordinary.

5. Where to track the fix

• Follow Microsoft’s update guide for CVE-2026-63512 to ensure you apply the correct package for your environment.

CISA KEV status

• This CVE is not listed in CISA KEV (per the provided findings), but it still has an available fix and is marked RED for urgency based on the tampering authorization risk and security attention during this cycle.

CVE-2026-63512 is an authenticated authorization/tampering issue (CWE-863) in Microsoft SharePoint Server. The mechanism is incorrect handling of access rights that lets a low-privileged authenticated attacker tamper with information over the network.

Exploitation status

• No public exploit code was found in the provided findings.
• KEV: not listed in CISA KEV.
• Real-world reporting: no clear dated press claim of exploitation for this specific CVE in the provided findings.

Risk drivers in this case

• Network reachability is present in the vulnerability description, but authentication is required; the attacker must already have valid credentials.
• Because the impact is tampering (integrity impact), a compromised or abused low-privilege account can still cause meaningful damage (e.g., corrupting content).

Patch information

• Fixed builds are available for all affected SharePoint lines: 16.0.19725.20522 (SharePoint Server / Subscription Edition), 16.0.5565.1001 (SharePoint Enterprise Server 2016), and 16.0.10417.20198 (SharePoint Server 2019).

EPSS

• EPSS is a prediction and is not used as proof of exploitation here; KEV/news do not confirm exploitation for this CVE in the provided findings.