CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-20963 is a high severity deserialization vulnerability in Microsoft SharePoint Server that allows an authorized attacker to execute arbitrary code over the network. The vulnerability arises from the deserialization of untrusted data within SharePoint's server-side processing, enabling a low-privileged authenticated user to escalate to full code execution on the SharePoint server. With a CVSS v3.1 score of 8.8 (HIGH) and an EPSS score of 9.9%, CVE-2026-20963 poses a significant threat to organizations relying on SharePoint for document management and collaboration. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on March 18, 2026, with a remediation deadline of March 21, 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19127.20442; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2026-20963 is classified under CWE-502 (Deserialization of Untrusted Data). This weakness occurs when an application deserializes objects from an untrusted source without adequate validation, allowing an attacker to manipulate the serialized data to achieve unintended effects such as arbitrary code execution.
In CVE-2026-20963, Microsoft SharePoint Server deserializes user-supplied data without sufficient type constraints or integrity verification. An authenticated attacker with low-level site permissions can submit crafted serialized .NET objects through SharePoint's web interface. The server processes these objects through deserialization, triggering gadget chains that execute arbitrary commands in the context of the SharePoint application pool, which typically runs with elevated privileges.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2026-20963 carries a CVSS v3.1 base score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack is network-accessible with low complexity and requires only low-level privileges (such as a basic SharePoint site member), with no user interaction needed. The scope is Unchanged, meaning the impact is contained within the SharePoint server component.
Confidentiality (High): Successful exploitation grants the attacker access to all data stored in SharePoint, including documents, workflows, user credentials, and potentially database connection strings. SharePoint often serves as a central repository for sensitive corporate documents, making data exposure particularly impactful.
Integrity (High): The attacker can modify or delete SharePoint content, alter site configurations, inject backdoors into SharePoint workflows, and manipulate document libraries. Code execution on the server also enables modification of system files and installation of persistent access mechanisms.
Availability (High): The attacker can disrupt SharePoint services, corrupt databases, or leverage the compromised server for further attacks. Denial of service against a central collaboration platform can significantly impact organizational productivity.
The EPSS score of 9.9% confirms substantial real-world exploitation activity, and the 3-day CISA remediation deadline underscores the urgency of patching.
Exploit Maturity
CVE-2026-20963 demonstrates high exploit maturity with confirmed active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on March 18, 2026, with an extremely short remediation deadline of March 21, 2026 (only 3 days), reflecting the severity and active threat.
The EPSS score of 9.9% indicates significant exploitation probability. SharePoint deserialization vulnerabilities have a well-established history of weaponization. Previous SharePoint deserialization CVEs (such as CVE-2019-0604 and CVE-2022-29108) were exploited by both nation-state actors and cybercriminal groups. Mature .NET deserialization tooling and publicly available gadget chains make exploitation accessible once a deserialization endpoint is identified.
The requirement for low-level authentication (PR:L) reduces the attack surface compared to unauthenticated vulnerabilities, but compromised or legitimate low-privileged accounts are readily available to determined attackers. Many SharePoint deployments also permit guest or external user access, further expanding the pool of potential attackers.
Remediation
-
Apply the Microsoft security update immediately. Install the latest SharePoint Server cumulative update or security patch that addresses CVE-2026-20963. Given the 3-day CISA remediation deadline, this should be treated as an emergency patch with the highest priority.
-
Review and restrict SharePoint permissions. Audit user permissions across all SharePoint sites and remove unnecessary access. Since the vulnerability requires low-level authentication, minimizing the number of accounts with any SharePoint access reduces the attack surface.
-
Disable or restrict external and guest access. If SharePoint sites permit external sharing or guest access, consider temporarily disabling these features until the patch is applied. External users represent an additional attack vector for authenticated exploitation.
-
Monitor SharePoint server logs for suspicious activity. Review ULS logs, Windows Event logs, and IIS logs for indicators of deserialization attacks, including unusual HTTP POST requests with large or obfuscated payloads, unexpected process spawning from the SharePoint application pool, and error messages related to object deserialization.
-
Conduct forensic investigation if compromise is suspected. Check for web shells, unauthorized scheduled tasks, new administrative accounts, and evidence of lateral movement from the SharePoint server. SharePoint deserialization exploits often lead to web shell deployment as a persistence mechanism.
-
Implement network segmentation. Ensure the SharePoint server is isolated in a dedicated network segment with restricted outbound connectivity to limit the impact of compromise and prevent lateral movement to other systems.
Technical Details
CVE-2026-20963 is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a score of 8.8. The vulnerability exists in SharePoint's server-side processing of serialized .NET objects. An authenticated attacker with minimal site permissions can submit specially crafted serialized payloads through the SharePoint web interface. The server deserializes these payloads without adequate type filtering, enabling the attacker to leverage known .NET gadget chains to execute arbitrary code. The code executes in the context of the SharePoint IIS application pool identity, which typically holds significant privileges on the server including database access and file system permissions. The Unchanged scope (S:U) indicates the impact is contained to the SharePoint server component, though in practice the server's privileges and network position make it an effective pivot point for further attacks within the organization's infrastructure.
Frequently Asked Questions
Is CVE-2026-20963 being actively exploited?
Yes. CISA added CVE-2026-20963 to the Known Exploited Vulnerabilities catalog on March 18, 2026, with a remediation deadline of March 21, 2026. The EPSS score of 9.9% confirms significant exploitation activity.
What products are affected by CVE-2026-20963?
Microsoft SharePoint Server is affected. Consult the Microsoft Security Response Center advisory for specific version details and patch availability.
How do I fix CVE-2026-20963?
Apply the latest Microsoft SharePoint Server security update immediately. As additional mitigation, review and restrict SharePoint user permissions and disable external or guest access until the patch is installed.
How severe is CVE-2026-20963?
With a CVSS score of 8.8 (HIGH), active exploitation, and a 3-day CISA remediation deadline, CVE-2026-20963 is a serious threat. It enables authenticated attackers with minimal permissions to achieve full code execution on the SharePoint server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.