Defused says attackers are already targeting Microsoft SharePoint servers with a public proof-of-concept that chains two flaws, CVE-2026-45659 and CVE-2026-63520, into remote code execution on unpatched systems.
The chain links two separate SharePoint bugs so one request opens the way for the next, ending with code running on the server. In plain terms, a normal-looking web action can turn into command execution once the two flaws are combined, which makes the attack repeatable instead of hand-crafted.
That shifts the problem from a theoretical disclosure to an internet-facing access path: any exposed SharePoint host that stays unpatched can be treated as a commodity target. For operators with SharePoint in front of internal data or workflows, the exposure sits at the server layer until the vulnerable chain is removed.
CVSS 8.8 HIGH: deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a… EPSS 3% (85th percentile). Microsoft patch: 5002868.
CVSS 8.1 HIGH: improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. Microsoft patch: 5002905.
Hackers target Microsoft SharePoint RCE chain with PoC exploit
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused.