Yes. CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalogue on 18 March 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
What “being exploited in the wild” means for this CVE
This question is less about the vulnerability label and more about operational reality. “In the wild” means defenders should treat the issue as an active exposure, not a theoretical flaw. For SharePoint, that usually shifts the response from ordinary patch planning to immediate exposure checking, mitigation, and compromise review.
For a deserialization of untrusted data flaw, the practical concern is remote code execution over the network. That means the attack surface is not limited to local misuse or edge-case input handling, and the consequences can extend from one vulnerable endpoint to full server-level compromise if the application is reachable.
A useful way to frame it is that exploitation status changes the urgency, not the technical category. The same class of flaw can exist quietly for months, but once exploitation is confirmed, the defender has to assume real attackers already know how to trigger it and may be chaining it with other access paths.
What defenders should check first on SharePoint
Start by confirming whether the affected SharePoint instance is Internet-facing, reachable from partner networks, or accessible through any high-trust internal path. If it is exposed, assume it is part of the active hunt set and verify whether the vendor guidance and CISA KEV entry indicate immediate remediation or a specific mitigation path.
The next question is whether the server shows signs of post-exploitation activity. With deserialization exploits, review for unexpected process creation, web shell indicators, unusual child processes from the web service, newly created files in application paths, and outbound connections that do not fit the server’s normal role.
If the system handled sensitive content, credentials, or administrative workflows, widen the review to adjacent systems that may have been reached after initial code execution. A server compromise often becomes a pivot point, not an isolated event, especially when the application sits near identity, content, or collaboration infrastructure.
How to respond when patching cannot happen immediately
When remediation must wait, the goal is to reduce exploitability and improve detection quality, not to assume the absence of compromise. Restrict exposure as tightly as possible, apply vendor mitigations, and place the system under heightened monitoring so that suspicious execution patterns are visible quickly.
If the SharePoint host has privileged access to file shares, databases, or directory-connected services, treat that access as potentially exposed and review whether service accounts, application secrets, or integrated credentials should be rotated. This is especially important when the server could have been used to obtain follow-on access after code execution.
Where available, use CISA Known Exploited Vulnerabilities Catalog and the vendor advisory together to decide whether you are dealing with a patch-now event, a mitigation-first event, or a broader incident response event. If the service is business critical, isolate the host before you let convenience drive the decision.
Risk and Threat Considerations
Active exploitation changes the threat model from “potential exposure” to “probable attacker attention.” For a network-reachable deserialization flaw, the main risk is not just code execution, but the speed with which an attacker can turn that execution into persistence, lateral movement, or data access on a server that often has broad trust.
Failure mechanism: The application accepts attacker-controlled serialized input, reconstructs objects unsafely, and allows code execution before normal authorization or business logic can stop it. Once a server-side process is running under the application context, the attacker can often enumerate local secrets, modify content, or stage a second payload.
Impact: The likely outcomes include server compromise, data exposure, credential theft, and internal pivoting from a trusted collaboration platform. In environments where SharePoint is tied to internal workflows, the blast radius can extend beyond the host itself into adjacent identity, content, and infrastructure services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid identification and remediation of vulnerable SharePoint hosts essential. |
| Recommendation — Prioritize and remediate the vulnerable asset immediately, then verify exposure reduction and remediation status. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The question is about an exploited software flaw and the need to apply fixes or mitigations quickly. |
| SI-4 — System Monitoring | In-wild exploitation requires monitoring for signs of compromise before and after remediation. | |
| Recommendation — Apply the fix or mitigation promptly and track remediation through closure. Increase detection for anomalous execution, web shells, and suspicious outbound activity. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Deserialization exploitation is best handled with strong logging to support compromise investigation. |
| Recommendation — Retain and review logs that can show exploit attempts, code execution, and post-exploit actions. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | The vulnerability is an exploitable network-reachable application flaw that can lead to remote code execution. |
| Recommendation — Hunt for external exploitation paths and correlate them with server-side execution indicators. | ||
Practitioner Guidance
What to verify: Verify exposure status, patch or mitigate according to vendor and CISA guidance, and then validate whether the host shows evidence of execution that should not have occurred. Do not stop at successful patching if the server may already have been used as a foothold.
Decision rule: If the instance was reachable during the exploitation window, treat compromise review as mandatory. If the server has privileged integrations or stored secrets, prioritize credential and session review alongside malware hunting because post-exploit access can outlive the original flaw.
Practitioner takeaway: For an actively exploited SharePoint deserialization flaw, the right question is not “is it patched yet?” but “was it reachable, was it abused, and what access could the attacker have inherited from that server?”
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- Is CVE-2026-50522 (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability) being exploited in the wild?
- Is CVE-2026-58644 (Microsoft SharePoint Deserialization of Untrusted Data) being exploited in the wild?
- Is CVE-2025-53770 (Microsoft SharePoint Deserialization of Untrusted Data) being exploited in the wild?
- How do you patch or mitigate CVE-2026-20963 (Microsoft SharePoint Deserialization of Untrusted Data)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org