CVE-2026-20963: Microsoft SharePoint unauthenticated deserialization RCE, actively exploited
The short version: Microsoft SharePoint has a deserialization-of-untrusted-data flaw (CVE-2026-20963) that lets an unauthenticated attacker execute code over the network. It scores 9.8, it's in CISA's Known Exploited Vulnerabilities catalog, and the remediation window was measured in days. If you run SharePoint on-premises, this is patch-now, then verify you weren't already touched. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 29.43% · 97.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-03-21 |
| Known exploited? | Yes — added to KEV on 2026-03-18 |
| Vulnerability type | CWE-502 deserialization of untrusted data → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Microsoft SharePoint Server (2016, 2019, and Subscription Edition) — on-premises |
| Fixed in | The Microsoft security update for CVE-2026-20963 (see MSRC advisory) |
What you need to know
CVE-2026-20963 is a deserialization vulnerability: SharePoint accepts attacker-controlled serialized data and reconstructs it into live objects without safely validating it first. When that data is crafted correctly, the act of deserializing it triggers arbitrary code execution on the server — no login required.
That combination is what makes it top-of-queue:
- It's the SharePoint server itself. A collaboration platform typically holds sensitive documents and sits deep inside the network, so code execution there reaches far beyond one web page.
- It's pre-authentication and network-reachable. SharePoint front-ends are meant to be accessed by users, which is exactly the exposure an attacker needs.
- It's already being exploited. CISA added it to KEV with a same-week deadline — the theoretical is operational.
This affects on-premises SharePoint Server. SharePoint Online (Microsoft 365) is managed by Microsoft.
How serious we see it
High — the 9.8 is not hyperbole here.
Unauthenticated, network-reachable code execution on a server that stores an organization's documents, confirmed exploited and KEV-listed, is the definition of urgent. The bounded, reassuring part is that it's specific and fixable: it affects on-premises SharePoint, Microsoft has shipped an update, and you can determine quickly whether you run an exposed instance. The catch is the usual one for anything exploited before you patched — being patched and being clean are separate questions.
Recommendations
Straight from Microsoft's advisory and CISA:
- Patch now. Apply the Microsoft security update for CVE-2026-20963 to every on-premises SharePoint server.
- Assume nothing given the exploitation — hunt. Review web and server logs for unexpected process execution, new files, or web shells around and before your patch date.
- If you find indicators, respond fully. Isolate the server, rotate service-account credentials and machine keys, and investigate for lateral movement.
- Harden exposure. Keep SharePoint off the public internet where you can; put it behind VPN or a reverse proxy with authentication, and restrict who can reach it.
- Confirm your exposure first. Verify whether you run internet-facing on-premises SharePoint at all, and which build.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing SharePoint front-ends, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because unauthenticated RCE on a document server earns it.
That continuous, attacker's-eye view is the point: when a SharePoint zero-day breaks, the exposed server is already mapped, so you go straight to patch-and-verify instead of starting with an inventory.