Vulnerability intelligence
CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
CVSS Score
—
Unrated
EPSS — Exploit Probability
32%
Riskier than 98% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
KEV since 2026-03-18
Remediation
Unconfirmed
Federal deadline 2026-03-21
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-21.
5 articles across 5 outlets · first covered Mar 18, 2026 · latest Mar 19, 2026
Coverage timeline
-
CISA Warns of Attacks Exploiting Recent SharePoint Vulnerabilitywww.securityweek.com · Mar 19, 2026
-
CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacksthehackernews.com · Mar 19, 2026
-
CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 19, 2026
-
CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Cataloguecisa.gov · Mar 19, 2026
-
U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 18, 2026