CVE-2026-63520: Unauthenticated RCE in Microsoft SharePoint — Detection, Hunting, and Remediation Guide

Rapid7 has published analysis of CVE-2026-63520, an unauthenticated remote code execution vulnerability affecting on-premises Microsoft SharePoint Server. If you run SharePoint Subscription Edition, 2019, or 2016 — particularly any farm with endpoints reachable from the internet — this is a stop-what-you're-doing event.

The two words that matter most in the title are unauthenticated and code execution. An attacker does not need credentials, a phished session, or a foothold in your environment. They need network reachability to a vulnerable SharePoint endpoint. SharePoint's role as a document repository, identity-integrated collaboration platform, and frequent internet-facing service makes it one of the highest-value targets in any enterprise — and it has been a favored initial-access vector for both financially motivated actors and state-sponsored groups over the past several years precisely because exploitation yields code execution as a highly privileged service account on a domain-joined server.

This post breaks down what defenders need to know about CVE-2026-63520, how to hunt for exploitation and post-exploitation behavior, and how to remediate — including compensating controls if you cannot patch immediately.

Technical Analysis

What We Know

Per Rapid7's analysis (see References), CVE-2026-63520 allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable SharePoint server. Based on the vulnerability class and SharePoint's architecture, exploitation of this type of flaw typically lands execution inside the IIS worker process (w3wp.exe) running the SharePoint web application, under the context of the farm's application pool account — an account that commonly holds broad access to the SharePoint content databases and, in poorly hardened environments, excessive privileges on the host itself.

Key points for defenders:

• Affected products: On-premises Microsoft SharePoint Server deployments. SharePoint Online (Microsoft 365) is managed by Microsoft and is not the exposure surface here — confirm your hybrid boundaries and focus on on-prem farms.
• Attack vector: Network-based, no authentication required. Any SharePoint web application endpoint reachable by the attacker is candidate surface — including farms exposed only to the internal network (phishing-driven or post-compromise lateral movement still applies).
• Pre-conditions: From a defender's risk-modeling standpoint, assume none beyond network reachability. That is the conservative, correct posture for an unauthenticated RCE.
• Exploitation status: Rapid7's publication of analysis means technical detail is now public. Historically, public analysis of unauthenticated SharePoint RCEs is followed within days — sometimes hours — by weaponization, mass scanning, and exploitation of unpatched internet-facing servers. Treat exploitation as imminent-to-active and prioritize accordingly. Check the CISA Known Exploited Vulnerabilities catalog for current status; if listed, federal remediation deadlines apply and are a good forcing function for private-sector SLAs too.

Why SharePoint Exploitation Is So Damaging

A recurring pattern we see in IR engagements involving SharePoint initial access:

1. Exploitation delivers code execution inside w3wp.exe (the IIS worker process hosting the SharePoint application pool).
2. Webshell drop — attackers write an .aspx payload into a web-accessible SharePoint directory, classically under the LAYOUTS folder (e.g., C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\), giving them persistent, re-entrant access even if the original exploit vector is closed.
3. Command execution via cmd.exe, powershell.exe, or rundll32.exe spawned as children of w3wp.exe — reconnaissance (whoami, ipconfig, net group "Domain Admins" /domain), credential theft from the server, and staging.
4. Credential and data theft — SharePoint servers hold document stores, are domain-joined, and frequently run service accounts with weak credential hygiene. From here, lateral movement is straightforward.

Your detections should be built around steps 2 and 3, because those behaviors are observable regardless of the exact exploit primitive.

Detection & Response

The rules and queries below target the post-exploitation behaviors that are common to SharePoint RCE exploitation: suspicious child processes of the IIS worker process, webshell writes into SharePoint web directories, and the network behavior of the web server process. They are tuned for low noise — w3wp.exe spawning cmd.exe is almost never legitimate on a production SharePoint server.

Sigma Rules

---
title: IIS Worker Process Spawning Command Shell or Scripting Engine
id: 3f8a2c41-9b7e-4d52-a1c6-8e5f2d7b4a19
status: experimental
description: Detects w3wp.exe spawning cmd.exe, powershell.exe, or other command interpreters, consistent with post-exploitation activity following SharePoint RCE such as CVE-2026-63520.
references:
  - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate SharePoint solutions that invoke system commands from IIS worker processes (should be documented and allowlisted by farm)
level: high
---
title: Webshell File Written to SharePoint LAYOUTS or Web Directory
id: 7c1e5d93-2a48-4f36-b8e1-5d9c3a7f6b42
status: experimental
description: Detects creation of ASPX or ASP files in SharePoint web-accessible directories, a hallmark of webshell deployment following SharePoint exploitation such as CVE-2026-63520.
references:
  - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\inetpub\wwwroot\wss\'
      - '\inetpub\wwwroot\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate SharePoint solution deployments (WSP installs, feature deployments); correlate with change windows and deployment tooling
level: high
---
title: IIS Worker Process Initiating Outbound Network Connection to Rare External Host
id: 1b4d7f28-6e93-4c51-a2d8-9f3b5e8a1c76
status: experimental
description: Detects w3wp.exe making outbound network connections to non-standard ports, consistent with C2 or tooling download following SharePoint exploitation such as CVE-2026-63520.
references:
  - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\w3wp.exe'
    Initiated: 'true'
  filter_ports:
    DestinationPort:
      - 80
      - 443
  condition: selection and not filter_ports
falsepositives:
  - SharePoint outbound integrations (RSS, hybrid search, Office Online Server callbacks) on non-standard ports; baseline per farm and allowlist known destinations
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts the core post-exploitation chain in Defender for Endpoint telemetry: IIS worker processes spawning shells or reconnaissance tooling on SharePoint servers, joined with file drops into SharePoint web directories. Run it over at least the last 30 days, and scope DeviceName to your SharePoint farm if you have the inventory.

let SharePointWebDirs = dynamic(["Web Server Extensions\\15\\TEMPLATE\\LAYOUTS", "Web Server Extensions\\16\\TEMPLATE\\LAYOUTS", "inetpub\\wwwroot"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "nltest.exe"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName =~ "w3wp.exe"
    | where FileName in~ (SuspiciousChildren)
    | project ProcTime=TimeGenerated, DeviceName, ChildProcess=FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, ReportId;
let FileEvents =
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any (SharePointWebDirs)
    | where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asp" or FileName endswith ".asmx"
    | where ActionType in ("FileCreated", "FileModified")
    | project FileTime=TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, SHA256;
ProcEvents
| join kind=fullouter FileEvents on DeviceName
| extend AlertIndicator = coalesce(ProcTime, FileTime)
| order by DeviceName, AlertIndicator asc

For environments ingesting IIS or Sysmon logs into Sentinel via Syslog/CEF, an equivalent hunt against network behavior from the web tier:

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where ActionType == "OutboundConnection"
| where RemotePort !in (80, 443)
| where RemoteIPType == "Public"
| summarize Connections=count(), DistinctDestinations=dcount(RemoteIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, RemotePort
| order by FirstSeen asc

Velociraptor VQL

Use this hunt artifact across SharePoint farm members to enumerate suspicious child processes of IIS worker processes alongside recently created script files in SharePoint web directories — the two fastest triage indicators when you suspect webshell deployment.

-- SharePoint exploitation triage: suspicious w3wp children and webshell candidates (CVE-2026-63520)
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)cmd\.exe|powershell|pwsh|cscript|wscript|mshta|rundll32|certutil|whoami|nltest'

LET shells = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.ashx',
  'C:/inetpub/wwwroot/**/*.aspx'
])
WHERE Mtime > timestamp(epoch=now() - 30*24*3600)

SELECT 'process' AS Type, Exe AS Indicator, CommandLine AS Detail, Username AS Context, CreateTime AS EventTime FROM procs
UNION ALL
SELECT 'file' AS Type, FullPath AS Indicator, '' AS Detail, '' AS Context, Mtime AS EventTime FROM shells
ORDER BY EventTime DESC

Remediation

1. Patch Immediately

• Apply the Microsoft security update addressing CVE-2026-63520 to all on-premises SharePoint farm members (all web front ends and application servers). Consult the Microsoft Security Response Center advisory for the exact KB and build numbers applicable to your edition (Subscription Edition, 2019, 2016) — verify the applicable build in Central Administration or via the verification script below before and after patching.
• Vendor advisory and analysis: Rapid7 — Microsoft SharePoint RCE CVE-2026-63520
• Patch in the correct order for your farm topology, and confirm the SharePoint Products Configuration Wizard completes on every server — SharePoint updates are not fully applied until the configuration wizard runs.

2. If You Cannot Patch Immediately: Compensating Controls

• Remove internet exposure. If the farm is internet-facing and cannot be patched within hours, take it offline from the internet or place it behind a VPN/ZTNA gateway until patched. For an unauthenticated RCE, this is the single most effective compensating control.
• WAF/virtual patching: Deploy blocking rules for anomalous requests to SharePoint endpoints per your WAF vendor's emergency guidance for this CVE. Treat this as a bridge, not a fix.
• Egress restriction: Block outbound internet access from SharePoint servers except to explicitly required destinations. This blunts tooling download and C2 even if exploitation succeeds.
• AMSI: Verify AMSI integration is enabled for SharePoint (it is on by default in current builds) — it catches a meaningful share of in-memory post-exploitation scripting.

3. Hunt Before You Trust

Patching closes the door; it does not evict anyone already inside. Run the Sigma, KQL, and VQL content above against at least the last 30 days of telemetry before you consider the incident closed. If you find webshell artifacts or suspicious w3wp.exe child processes, treat the server as compromised: isolate it, acquire memory and disk images, rotate all service account and farm credentials (including the farm account and any credentials stored on the host), and initiate your IR process.

4. Verify Patch State

Use this PowerShell script on each farm member to report the installed SharePoint build, pending configuration-wizard state, AMSI status, and recent suspicious file drops in web directories:

# CVE-2026-63520 SharePoint verification and triage script
# Run elevated on each SharePoint farm member

# 1. Installed SharePoint build
$sp = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS" -ErrorAction SilentlyContinue
if ($sp) {
    Write-Host "[+] SharePoint Server Product Version: $($sp.ProductVersion)" -ForegroundColor Cyan
} else {
    $sp15 = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\WSS" -ErrorAction SilentlyContinue
    if ($sp15) { Write-Host "[+] SharePoint 2013-era build detected: $($sp15.ProductVersion)" -ForegroundColor Cyan }
}
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn | Format-Table

# 2. AMSI status for SharePoint
$amsi = Get-MpPreference -ErrorAction SilentlyContinue
if ($amsi) { Write-Host "[+] Defender real-time protection: $($amsi.DisableRealtimeMonitoring -eq $false)" -ForegroundColor Cyan }

# 3. Recent script files dropped in SharePoint web directories (last 30 days)
$cutoff = (Get-Date).AddDays(-30)
$paths = @(
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS",
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS",
    "C:\inetpub\wwwroot"
)
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asp,*.asmx -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
    }
}

# 4. Suspicious child processes of w3wp.exe (requires Sysmon or process auditing; fallback: live check)
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -in @("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","mshta.exe","rundll32.exe") -and
    (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue).Name -eq "w3wp.exe"
} | Select-Object ProcessId, Name, CommandLine | Format-List

5. Harden for the Next One

Because there will be a next one — SharePoint is a perennial target:

• Never expose SharePoint directly to the internet; front it with a properly patched reverse proxy/WAF.
• Run farm service accounts with least privilege; never as local admins on other hosts, never as Domain Admins.
• Ensure Sysmon (or equivalent process-creation telemetry) and IIS logs are collected and retained centrally — you cannot hunt what you never logged.
• Establish an emergency patch SLA for internet-facing services: unauthenticated RCE on an exposed service should be measured in hours, not change windows.

References

• Rapid7: Microsoft SharePoint unauthenticated remote code execution (CVE-2026-63520)
• Microsoft Security Response Center
• CISA Known Exploited Vulnerabilities Catalog

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub