CVE-2026-63516

SharePoint has a feature that takes network input and turns it into internal objects. In this vulnerability, a maliciously prepared message can be used by someone who already has low-level access to pretend to be someone else.

Think of it like forging a badge: even if you can only enter one side door, you might trick the system into believing you belong to a different department with different permissions.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (sharepoint server). The attacker needs low-level permissions (an authorized user), and the issue is triggered over the network without needing the victim to click anything.

Because reachability in a default configuration is not confirmed in the provided info, treat this as a serious risk for any environment where an attacker could gain low-level access to SharePoint (for example through compromised accounts).

This is RED because exploitation has been reported, meaning attackers are actively using this technique rather than relying on theory. The actor signal in the findings also points to Lazarus group activity tied to this patch.

Act immediately by verifying your SharePoint build and upgrading to the fixed versions for your edition.

1. Confirm exposure (quick check)

   • Identify which product/edition you run: SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition.
   • In the SharePoint server, check the installed SharePoint build/version number.
   • Determine whether your build matches (or is older than) the fixed versions below.

2. Apply the fix (upgrade path)

   • Upgrade SharePoint to:
     • 16.0.5565.1001 for Microsoft SharePoint Enterprise Server 2016
     • 16.0.10417.20198 for Microsoft SharePoint Server 2019
     • 16.0.19725.20522 for Microsoft SharePoint Server Subscription Edition (and the “sharepoint server” entry)
   • Use the Microsoft update guidance for CVE-2026-63516 to select the correct update(s) for your environment.

3. Validate

   • After patching, re-check the SharePoint build number to confirm it is exactly the fixed version for your edition.
   • Verify that authentication flows and key permission checks still work normally (this is especially important after identity-related changes).

4. If you cannot patch right away (temporary containment)

   • Reduce the chance an attacker can reach the condition by tightening SharePoint user access:
     • Remove unnecessary low-privilege accounts and disable unused accounts.
     • Review sign-in events and account changes for suspicious activity.
   • Limit who can access SharePoint services from the network where possible (network-level access controls), since the spoofing can be performed over the network.

5. What to monitor after patching

   • Look for signs of identity-related abuse: unusual permission changes, unexpected service-to-user impersonation symptoms, and anomalous SharePoint activity by accounts that normally behave differently.

6. References

   • Microsoft update guide for CVE-2026-63516: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63516

Note: No KEV/CISA listing was provided in the findings, and no public exploit code was listed.

Severity/importance: While the published scoring is “medium” in the provided data, the overall handling should be urgent because exploitation has been reported.

Weakness (CWE-502): This is associated with unsafe handling of serialized data (a form of “unsafe deserialization”), which can allow an attacker to influence how the server interprets that input.

Mechanism: The findings state that an attacker can perform network-based spoofing by sending malicious serialized data to SharePoint. The consequence is impersonation of other users or services, tricking the system into believing the attacker is another identity. This impacts identity and access control integrity.

Authentication/interaction: Low authentication requirement is described in the findings, with a precondition that the attacker must have low-level permissions (authorized user). No user interaction is required.

Exploitation status: The findings include “exploitation reported: YES” (first reported 2026-08-11). KEV was not listed in CISA KEV, and no public exploit code was found in the provided exploit finding.

EPSS: A predicted likelihood value was provided in the findings, but it is not used for public decision-making here because exploitation reporting is treated as more reliable than prediction.

Actor signal: The PULSE finding associates this patch with Lazarus group activity.