CVE-2026-20963 is a deserialization of untrusted data vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 March 2026, which means attackers have used it in real attacks. Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
What this vulnerability means in SharePoint
Deserialization flaws are dangerous because they let an application turn attacker-controlled data into live objects or actions without sufficient trust checks. In a product like Microsoft SharePoint, that can collapse the boundary between ordinary user input and server-side execution, which is why the issue is treated as code execution over the network.
The practical lesson is that the vulnerable condition is not just “bad input handling”, it is unsafe object reconstruction in a component that may already be reachable by authenticated users, exposed endpoints, or integrations. When that trust boundary fails, the attacker is no longer limited to corrupting data, they can influence application behaviour at execution time.
How organisations assess exposure
Exposure checks start with a complete asset inventory of SharePoint deployments, including internet-facing instances, connected web applications, and any environments that may have inherited the same configuration or packaging pattern. For a KEV-listed issue, the first question is whether the vulnerable product is present and reachable in a way an attacker can actually use.
Teams should then compare their estate against the vendor advisory and the NIST National Vulnerability Database and confirm whether the affected service is exposed to untrusted network traffic. If the product is externally reachable, the exposure is more urgent because the attack path does not depend on local access. The CVE Program remains the authoritative reference point for identifier-level tracking, while CISA KEV tells you the vulnerability is already being exploited in the wild.
For SharePoint environments, organisations should also review whether adjacent controls, such as segmentation, reverse proxy rules, and application logging, would meaningfully reduce the reachable attack surface while remediation is pending.
Remediation and compensating controls
Primary remediation is to apply the vendor fix as soon as operationally possible, because deserialization flaws usually cannot be made truly safe by configuration alone. When patching is delayed, compensating controls should focus on reducing reachability, limiting who can invoke the vulnerable path, and preserving the ability to detect abuse.
That usually means restricting network exposure, tightening access to the SharePoint surface, and validating whether any temporary workarounds still preserve business functionality. If the service cannot be taken down immediately, risk reduction is about shrinking the number of requests that can reach the vulnerable code, not assuming that perimeter trust will hold.
For current exploitation patterns and prioritisation context, NHIMG’s Vulnerability Management Guide is a useful companion reference, and the NIST Cybersecurity Framework 2.0 provides a good governance lens for identifying, protecting, detecting, responding, and recovering around actively exploited flaws.
Detection, compromise review, and identity impact
Because this vulnerability supports remote code execution, defenders should look for signs that the SharePoint host was used as an execution foothold rather than only searching for a failed exploit attempt. That means reviewing web and application logs, command execution traces, unexpected child processes, anomalous network connections, and any persistence mechanisms planted after initial access.
Post-patch review matters because exploitation can leave behind stolen credentials, altered service configurations, or attacker-controlled web components even after the original flaw is fixed. If the server was compromised, teams should treat any credentials, session material, or service identities available to the application as suspect and review them for rotation or revocation.
ToolShell SharePoint exploitation 2025 is a relevant reference point for why patching alone may not be enough when attacker activity persists after initial compromise. The broader breach pattern is also captured in The State of NHI & AI Agent Breach Report 2026, which shows how stolen credentials and service access frequently extend the damage well beyond the original vulnerability.
Risk and Threat Considerations
This vulnerability is high risk because it gives an unauthorised attacker a direct path from network reachability to code execution in a widely deployed collaboration platform. Once an attacker can run code, the likely next steps are persistence, data access, and lateral movement into connected systems.
Failure mechanism: The application accepts untrusted serialized input and reconstructs it in a way that can be shaped into executable behaviour, which turns a normal request into a server-side execution event.
Impact: Compromise can extend beyond the SharePoint instance itself, exposing content, credentials, adjacent systems, and the trust relationships that the server can reach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Vulnerability Risk Assessment | Actively exploited CVEs require risk-based prioritisation and exposure review. |
| PR.PS-01 — Secure Configuration | Compensating controls depend on reducing attack surface while remediation is pending. | |
| DE.CM-01 — Networks and Network Services Monitored | Post-exploitation detection relies on monitoring for suspicious network and host activity. | |
| Recommendation — Prioritise exposed SharePoint assets and track this KEV item in your risk register. Harden SharePoint exposure and restrict reachable attack paths until patching is complete. Monitor SharePoint telemetry for anomalous requests, execution, and outbound connections. | ||
Practitioner Guidance
Why practitioners should care: For a KEV-listed SharePoint flaw, the practical issue is not just patch hygiene, it is whether the platform is still exposed to a known exploitation path that can become a foothold for broader compromise. Prioritise it as a live exploitation problem, not a routine defect.
Practitioner takeaway: If the host cannot be patched immediately, reduce reachability, intensify monitoring, and assume post-exploitation review may require credential and session rotation.
Related resources from NHI Mgmt Group
- CVE-2026-50522 (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability)
- CVE-2026-58644 (Microsoft SharePoint Deserialization of Untrusted Data)
- CVE-2025-53770 (Microsoft SharePoint Deserialization of Untrusted Data)
- CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data)