CVE-2026-20963

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20963 9.8

Microsoft · SharePoint · Added 2026-03-18 · Published 2026-01-13

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability

VendorMicrosoft

ProductSharePoint

Date added2026-03-18

Due date2026-03-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

NVD: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-16 05:01 UTC

Wall time30.0s

Searches5

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963
https://nvd.nist.gov/vuln/detail/CVE-2026-20963
https://www.truesec.com/hub/blog/cve-2026-20963
https://www.sentinelone.com/vulnerability-database/cve-2026-20963/
https://www.helpnetsecurity.com/2026/03/19/sharepoint-vulnerability-cve-2026-20963-exploited/
https://learn.microsoft.com/en-us/answers/questions/5832349/cve-2026-20963-sharepoint-rce
https://github.com/jenniferreire26/CVE-2026-20963

QC notes

warn component_extraction: Component 'SharePoint Server web components (deserialization endpoints)' matches or contains product name 'SharePoint' — no specific component identified

Hunting hypothesis agent

Monitor for unauthenticated HTTP requests that trigger deserialization of untrusted data in Microsoft SharePoint Server's web components.

Research details

ComponentSharePoint Server web components (deserialization endpoints)

PreconditionsTarget must run a vulnerable version of Microsoft SharePoint Server (Subscription Edition prior to 16.0.19127.20442, SharePoint Enterprise Server 2016 prior to 16.0.10417.20083, or SharePoint Server 2019 prior to 16.0.5535.1001). The SharePoint web services must be network-reachable on the standard HTTP/HTTPS ports. No authentication is required - the vulnerability is exploitable pre-authentication. An attacker sends a crafted deserialization payload via an HTTP request to a SharePoint web component, triggering remote code execution on the server. The vulnerability was fixed in the January 2026 security update (KB5002825), and no workarounds are available. agent

Deliverycrafted deserialization payload sent via HTTP to SharePoint Server web components

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

SummaryCVE-2026-20963 is a critical (CVSS 9.8) deserialization of untrusted data vulnerability in Microsoft SharePoint Server affecting Subscription Edition, 2016, and 2019. The flaw allows an unauthenticated, remote attacker to execute arbitrary code by sending a crafted deserialization payload to SharePoint web services over a network. Active exploitation has been confirmed, and CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on March 18, 2026.

Tia coverage

First reported2026-05-27

First exploit report2026-05-27

Exploit report → KEV70 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-45659-microsoft-sharepoint-server-deserialization-rce-c

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.