CTI · corroborated · 2026-08-14

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1606 Forge Web Credentials Credential Access
• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed
• https://gbhackers.com/microsoft-sharepoint-rce-vulnerability/
• https://cyberpress.org/microsoft-sharepoint-rce-flaw/
• https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040
• https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-sharepoint-vulnerabilities/
• https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
• https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/
• https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/