CISA Warns of Microsoft SharePoint Vulnerability Exploited in Attacks

Microsoft SharePoint Vulnerability Update

A significant security vulnerability in Microsoft SharePoint, identified as CVE-2026-20963, has been added to the Known Exploited Vulnerabilities (KEV) catalog as of Wed, Mar 18, 2026. This vulnerability is actively being exploited in network attacks.

The vulnerability originates from the way Microsoft SharePoint handles the deserialization of untrusted data. Deserialization involves converting data structured for storage or network transfer back into live, executable objects. If the application does not verify incoming data's safety, attackers can exploit this process.

An unauthorized, remote attacker can craft a malicious data packet and send it to a susceptible server, resulting in arbitrary code execution without needing valid user credentials. This poses a substantial risk as SharePoint typically stores sensitive enterprise documents and communications.

The inclusion of CVE-2026-20963 in the KEV catalog suggests active exploitation. Although specific advanced persistent threat (APT) groups behind these attacks are unidentified, the flaw is valuable for initial access brokers and ransomware syndicates. Successful exploitation allows attackers to deploy secondary payloads, establish backdoors, and potentially execute extortion campaigns.

CISA has issued strict remediation directives under Binding Operational Directive 22-01 for Federal Civilian Executive Branch (FCEB) agencies. All vulnerable instances of Microsoft SharePoint must be patched or mitigated by Sat, Mar 21, 2026. Private-sector organizations are advised to adhere to this timeline.

Administrators should immediately review Microsoft's security advisories and apply all available updates. If patching is not feasible, vendor-supplied mitigations should be applied. If no mitigations are available, discontinuing use of the vulnerable product is advised until a permanent fix is implemented.

Based on reporting by Cyber Security News.