In CISA KEV9.8 CriticalCWE-502
CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
MicrosoftSharePoint
Status
- Exploited in the wild
- In CISA KEV since 18 Mar
- Vendor fix available
Federal deadlineSat 21 Mar, 23:59 UTC
Passed 217 days ago
CISA KEV · added 18 Mar
Exploit probabilityEPSSchecked 24 Oct
29%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 5 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Mar · 21:48 UTC | Security Affairs | U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog |
| Thu 19 Mar · 00:42 UTC | CISA | CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Catalogue |
| Thu 19 Mar · 02:38 UTC | CISA | CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities Catalogue |
| Thu 19 Mar · 06:56 UTC | The Hacker News | CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks |
| Thu 19 Mar · 09:59 UTC | SecurityWeek | CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability |
- CISA Warns of Attacks Exploiting Recent SharePoint VulnerabilitySecurityWeek
- CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware AttacksThe Hacker News · mentions it in passing
- CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- CISA Adds CVE-2026-20963 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · first in our coverage