CVE-2026-20963

Published Jan 13, 2026

Last updated a month ago

Tunneling protocol

Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20963 is a deserialization of untrusted data vulnerability impacting Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019, and Microsoft SharePoint Enterprise Server 2016. This flaw allows an unauthorized attacker to achieve remote code execution (RCE) through a low-complexity network-based attack. No user interaction is required for exploitation, enabling an unauthenticated attacker to inject and execute arbitrary code remotely on the SharePoint Server. The vulnerability stems from improper handling of untrusted data during deserialization operations. Although Microsoft initially assessed the vulnerability as "less likely" to be exploited when the fix was released in January 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) later added CVE-2026-20963 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.

Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: sharepoint_server

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Exploit added on: Mar 18, 2026
Exploit action due: Mar 21, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*",
            "matchCriteriaId": "FB9ECA81-C1E2-4B02-A45C-0E5664E3C9B9",
            "versionEndExcluding": "16.0.19127.20442",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "F815EF1D-7B60-47BE-9AC2-2548F99F10E4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*",
            "matchCriteriaId": "6122D014-5BF1-4AF4-8B4D-80205ED7785E",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.