Cyber

What changed

Rapid7 Labs has uncovered a significant security issue within Microsoft SharePoint, consisting of two vulnerabilities that, when exploited together, enable unauthenticated remote code execution (RCE). The second vulnerability, identified as CVE-2026-63520, has been disclosed alongside the first, CVE-2026-55040, which was revealed last month.

• CVE-2026-63520 allows attackers to execute arbitrary code remotely.
• CVE-2026-55040 serves as a prerequisite for the exploitation of CVE-2026-63520.
• Both vulnerabilities pose a severe risk to the security of SharePoint servers.

Who is affected

Organizations utilizing Microsoft SharePoint are at risk due to these vulnerabilities. The potential impact is significant, affecting various sectors that rely on SharePoint for collaboration and document management.

• Microsoft SharePoint users across multiple industries.
• Organizations with outdated or unpatched SharePoint installations.
• IT departments responsible for maintaining SharePoint environments.

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with these vulnerabilities. Regular updates and patches should be applied to ensure systems are secure.

Monitor for any unusual activity on SharePoint servers and implement additional security measures as needed.

• Review and apply the latest security patches from Microsoft.
• Conduct a security audit of SharePoint installations.
• Educate staff on the risks associated with these vulnerabilities.

What changed

Microsoft has identified a missing authentication vulnerability in SharePoint Server that could allow unauthorized attackers to elevate their privileges over a network. This flaw could lead to severe security breaches if not addressed promptly.

Who is affected

Organizations utilizing Microsoft SharePoint Server are at risk due to this vulnerability. The following groups should be particularly vigilant:

IT departments managing SharePoint environments need to ensure their systems are secured against potential exploitation.

• Microsoft SharePoint Server users
• Organizations with on-premises SharePoint deployments
• IT security teams responsible for maintaining SharePoint infrastructure
• Businesses relying on SharePoint for collaboration and document management

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Regular updates and patches should be applied to SharePoint Server installations.

Conduct a thorough assessment of your SharePoint environment to identify any potential exposure and implement necessary security measures.

• Review and apply the latest security patches from Microsoft.
• Implement strict access controls and monitor user activities within SharePoint.
• Conduct regular security audits to ensure compliance and identify vulnerabilities.
• Educate staff on the importance of security best practices related to SharePoint usage.