SecurityWeekEduard Kovacs
CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability
According to CISA, a recently patched Microsoft SharePoint remote code execution vulnerability, CVE-2026-20963, has been exploited in the wild. Microsoft outlined the flaw as a critical RCE (CVSS 9.8) enabled by deserialisation of untrusted data and noted the issue affects SharePoint Server 2016, 2019 and Subscription Edition, with the vulnerability disclosed on 13 January 2026 and patched in January 2026 Patch Tuesday updates.
CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities (KEV) catalog on 18 March, with agencies instructed to address it by 21 March. Microsoft updated its advisory on 17 March but did not indicate active exploitation, and there is no public information about ongoing attacks at present. The KEV catalog currently lists nine SharePoint vulnerabilities, including three disclosed in 2025 linked to the ToolShell attacks.
AI summary of the original article from SecurityWeek, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made
Story timeline CVE-2026-20963
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Mar · 21:48 UTC | Security Affairs | U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog |
| Thu 19 Mar · 00:42 UTC | CISA | CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Catalogue |
| Thu 19 Mar · 02:38 UTC | CISA | CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Catalogue |
| Thu 19 Mar · 06:56 UTC | The Hacker News | CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks |
| Thu 19 Mar · 09:59 UTC | SecurityWeek | CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability (this article) |