CVE-2026-63516

SharePoint has a feature that takes network input and turns it into internal objects. In this vulnerability, a maliciously prepared message can be used by someone who already has low-level access to pretend to be someone else.

Think of it like forging a badge: even if you can only enter one side door, you might trick the system into believing you belong to a different department with different permissions.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (sharepoint server). The attacker needs low-level permissions (an authorized user), and the issue is triggered over the network without needing the victim to click anything.

Because reachability in a default configuration is not confirmed in the provided info, treat this as a serious risk for any environment where an attacker could gain low-level access to SharePoint (for example through compromised accounts).

This is RED because exploitation has been reported, meaning attackers are actively using this technique rather than relying on theory. The actor signal in the findings also points to Lazarus group activity tied to this patch.

Act immediately by verifying your SharePoint build and upgrading to the fixed versions for your edition.