Overview
CVE-2026-20963 is a remote code execution vulnerability in Microsoft SharePoint Server. The flaw arises from deserialization of untrusted data (CWE-502) in the SharePoint web application. An unauthenticated, remote attacker can send crafted serialized data over the network to trigger arbitrary code execution on the SharePoint server.
SharePoint is one of the most widely deployed enterprise collaboration platforms globally, used by organizations for document management, intranet portals, and business workflows. An unauthenticated RCE vulnerability in SharePoint provides attackers with direct access to an organization's internal document stores, credentials, and network.
Critical Severity Upgrade & KEV Listing
The timeline of this vulnerability reveals a significant re-assessment that dramatically changed its risk profile:
| Date | Event |
|---|---|
| January 13, 2026 | Microsoft publishes advisory (v1.0). CVSS 8.8 HIGH and patches released for all affected versions. |
| March 17, 2026 | Microsoft revises advisory (v1.1). Corrects CVSS to 9.8 CRITICAL and updates the attack model to unauthenticated attacker (PR:N). |
| March 18, 2026 | CISA adds to KEV catalog with 3-day emergency deadline (March 21) |
Mitigation & Remediation
Immediate Actions
- Apply January 2026 security updates immediately (KB5002822, KB5002825, KB5002828).
- Restrict network access to SharePoint web frontends and avoid direct internet exposure.
- Review IIS and SharePoint ULS logs for suspicious deserialization-related requests.
- Monitor for post-exploitation behavior such as unusual processes spawned by SharePoint worker processes or suspicious outbound connections.
Key Details
| Property | Value |
|---|---|
| CVE ID | CVE-2026-20963 |
| Vendor / Product | Microsoft — SharePoint |
| NVD Published | 2026-01-13 |
| NVD Last Modified | 2026-04-01 |
| CVSS 3.1 Score | 9.8 |
| CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Severity | CRITICAL |
| CWE | CWE-502 find similar ↗ |
| CISA KEV Added | 2026-03-18 |
| CISA KEV Deadline | 2026-03-21 |
| Known Ransomware Use | No |
CVSS 3.1 Breakdown
Required Action
Timeline
| Date | Event |
|---|---|
| 2026-01-13 | Microsoft publishes advisory v1.0 with CVSS 8.8 HIGH (Privileges Required: Low); patches released |
| 2026-03-17 | Microsoft revises advisory v1.1: corrects to unauthenticated attack (PR:N), upgrades CVSS to 9.8 CRITICAL |
| 2026-03-18 | Added to CISA Known Exploited Vulnerabilities catalog (3-day emergency deadline) |
| 2026-03-21 | CISA BOD 22-01 remediation deadline |
References
| Resource | Type |
|---|---|
| NVD — CVE-2026-20963 | Vulnerability Database |
| CISA KEV Catalog Entry | US Government |
| Microsoft Security Response Center — CVE-2026-20963 | Vendor Advisory |
| KB5002822 — SharePoint Server Subscription Edition Security Update | Vendor Advisory |
| KB5002825 — SharePoint Server 2019 Security Update | Vendor Advisory |
| KB5002828 — SharePoint Enterprise Server 2016 Security Update | Vendor Advisory |