CVE-2026-20963 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-01-13

Added to CISA KEV: 2026-03-18 64 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, scan for webshells and ransomware artifacts
Apply Microsoft security updates immediately: Update to SharePoint 2016 16.0.5535.1001+, SharePoint 2019 16.0.10417.20083+, or SharePoint Subscription Edition 16.0.19127.20442+
Monitor SharePoint access logs for suspicious authentication patterns, unusual file uploads, and unauthorized administrative activities
EMERGENCY patch priority - treat as critical infrastructure vulnerability with confirmed active exploitation

Disrupting active exploitation of on-premises SharePoint ...
Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities. Microsoft has released new comprehensive security updates for all supported versions of SharePoint Server ...
CVE-2026-20963 Impact, Exploitability, and Mitigation Steps | Wiz
Understand the critical aspects of CVE-2026-20963 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.CVE-2026-20963: vulnerability analysis and mitigation. Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-20963 Detail - NVD
Description. Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA
Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.

🔴 CVE-2026-20963