CVE-2026-63514

This vulnerability lets someone who already has an account for SharePoint send “poisoned” data to the server. If they do, SharePoint can be tricked into running harmful commands, like an attacker handing the server a malicious instruction set. In a worst case, that can lead to full control of the server and damage to business operations.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including environments described as “sharepoint server”).

Because this requires valid authentication to access SharePoint, it’s mainly a risk if an attacker can log in (for example, via stolen credentials or an account takeover). It becomes dangerous when your SharePoint is reachable from where attackers can attempt authenticated access.

This is RED because the flaw is capable of remote code execution and requires only an authenticated attacker to trigger it. Even though there’s no confirmed public exploitation for this specific CVE in the reporting you provided, this class of weakness is exactly what attackers use once they have a foothold.

Patch it urgently to remove the path from an authenticated attacker to full server compromise.