Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.1
- EPSS
- 3%
Affected versions
Key insight
RCE vulnerability in Microsoft SharePoint allows authenticated attackers to execute arbitrary code; exploit details reveal XML-based Business Data Catalog manipulation as the attack vector.
Description
CVE-2026-63520 is a critical remote code execution vulnerability in Microsoft SharePoint allowing authenticated users to execute arbitrary code in the SharePoint process context. The exploit manipulates Business Data Catalog (BDC) XML configuration to inject commands. The vulnerability requires authentication, limiting risk to internal or compromised users. Microsoft and Rapid7 jointly disclosed the vulnerability on August 11, 2026, and released a patch.
Risk score
- cvss base
- 81.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 96.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 15.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
CVE_ABSENTTitle-claimed CVE missing from description −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0