cve-2026-63520

2 articles · newest first

Microsoft SharePoint interface on a laptop screen in an office setting

Microsoft's SharePoint bug had a missing half. Someone just published it — and honeypots are already lighting up

The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.

Priya Nair · 6d ago · 7 min

Rows of server racks in a data center, representing the enterprise SharePoint infrastructure exposed by CVE-2026-63520

Software

an AI spent 24 days hacking SharePoint. it found a way in that needs zero login

Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.

Priya Nair · Aug 13 · 6 min