2026-004: Critical Vulnerability in SharePoint Exploited
CVE-2026-20963 (CVSS 9.8), an unauthenticated RCE in on-prem SharePoint, was added to CISA's KEV on 18 March 2026 and is actively exploited.
CERT-EU warns about CVE-2026-20963, a CVSS 9.8 unauthenticated remote code execution flaw in SharePoint caused by deserialisation of untrusted data, affecting SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Microsoft raised the CVSS score on 17 March 2026 and the flaw entered CISA's Known Exploited Vulnerabilities catalogue on 18 March 2026. Three additional SharePoint RCE flaws (CVE-2026-26106, CVE-2026-26113, CVE-2026-26114) were fixed in the March 2026 release. CERT-EU urges immediate patching of internet-facing servers plus AMSI Full Mode, EDR deployment, ASP.NET machine key rotation, and compromise assessments.
- CVE-2026-20963 (CVSS 9.8): unauthenticated RCE via deserialisation of untrusted data
- Added to CISA KEV on 18 March 2026, indicating confirmed exploitation
- Affects SharePoint Subscription Edition, Server 2019, and Enterprise Server 2016
- Three further RCEs (CVE-2026-26106/26113/26114) patched in March 2026
- Mitigations: AMSI in Full Mode, EDR, rotate ASP.NET machine keys
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20963 | Deserialization RCE in Microsoft SharePoint Exploited in the Wild | 9.8 | 29% | KEV | KEV |
CVE-2026-26114+1 related CVE | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network | 8.8 | 3% | ||
| CVE-2026-26113 | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally | 7.8 | <1% |
From the original article
1 min read at cert.europa.eu
On 17 March 2026, Microsoft updated one of its January 2026 security advisories related to a remote code execution vulnerability in Microsoft SharePoint. Specifically, Microsoft raised the CVSS score and changed the FAQ section to indicate that the vulnerability could be exploited by an unauthenticated attacker.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.