CVE-2026-63520

This vulnerability is like a bad “door lock” in SharePoint: an attacker can send specially crafted network requests and make the server run code they choose. For a business, that can mean the attacker gets control of the SharePoint server or uses it to reach sensitive files and disrupt services.

This matters to you if your business runs or hosts Microsoft SharePoint Server (SharePoint Server, SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) on your premises or in your managed environment. The risk is specifically about remote access: it is for an attacker who can reach the SharePoint server over the network, and it does not require valid login.
Only consider exposure if your SharePoint server is reachable from the internet and you are running a version that is not at the fixed build.

This is RED because press reporting indicates active exploitation activity tied to the Lazarus group. Even though we don’t have a CISA KEV entry or public exploit code on record, the combination of remote code execution plus reported exploitation means attackers may already be targeting vulnerable deployments.
Treat this as an immediate patch priority and update to the fixed build as soon as possible.