CVE-2026-20963: CISA Confirms Active Exploitation of Critical Microsoft SharePoint RCE

When the U.S. Cybersecurity and Infrastructure Security Agency adds a vulnerability to its Known Exploited Vulnerabilities catalog, the message is unambiguous: this is not a theoretical risk. Threat actors are using it right now, against real targets. On March 18, 2026, CISA made that declaration about CVE-2026-20963, a deserialization-of-untrusted-data flaw in Microsoft SharePoint Server that allows an unauthenticated attacker to execute arbitrary code remotely. The patch has existed since January 13, 2026. The window between patch release and confirmed active exploitation was roughly 65 days — a timeline that has become disturbingly routine for SharePoint vulnerabilities.

What makes this moment particularly significant is the broader context. CVE-2026-20963 is far from the first deserialization flaw to hit SharePoint, and it almost certainly will not be the last. Over the past 18 months, SharePoint's on-premises server deployments have been the focus of some of the most sophisticated exploitation campaigns observed in enterprise security, including the ToolShell attack chain in summer 2025 that was attributed to multiple Chinese state-sponsored threat groups. Understanding CVE-2026-20963 requires understanding that history — and understanding why deserialization in SharePoint keeps producing exploitable conditions even after years of vendor attention.

01 / The Technical Reality: What Deserialization Means Here

Deserialization vulnerabilities are classified under CWE-502 in the Common Weakness Enumeration framework. At their core, they arise when an application takes data from an untrusted source, converts it back into a live object in memory (the deserialization step), and executes logic associated with that object — all before properly validating whether the data is safe. For an attacker, this creates an opportunity to craft a malicious serialized payload that, when processed by the server, executes arbitrary code instead of performing the expected operation.

In SharePoint's case, the server is a high-value target precisely because of its architectural complexity. SharePoint integrates document management, workflow automation, web parts, authentication tokens, and third-party integrations into a single application layer running under Internet Information Services (IIS). The IIS worker process — w3wp.exe — handles incoming requests, and if a deserialization attack is successful, the attacker's code runs inside that same process. This gives attackers direct access to the server's memory space, the file system accessible by the IIS account, and the cryptographic material stored in the server's machineKey configuration.

According to Microsoft's advisory published January 13, 2026, CVE-2026-20963 specifically involves a network-based attack vector. No prior authentication is required for the attack to succeed, and the attack complexity is rated as low, meaning exploitation does not require specialized conditions or user interaction beyond the attacker sending a crafted request to an exposed SharePoint server. Technical analysis from CVEReports and SentinelOne confirms that the vulnerable implementation reads a Base64-encoded string from an HTTP POST request and passes it directly to an unconfigured deserializer. Attackers use gadget chains — sequences of classes and methods that execute arbitrary commands when triggered during deserialization — and tools such as ysoserial.net to generate payloads by leveraging classes already present in the .NET framework or SharePoint's internal libraries.

"In a network-based attack, an unauthenticated attacker could write arbitrary code to inject and execute code remotely on the SharePoint Server." Microsoft Security Response Center, Advisory for CVE-2026-20963, January 13, 2026

02 / Affected Versions and Scope

CVE-2026-20963 affects three actively supported versions of on-premises Microsoft SharePoint:

Product	Status	Patch Available
SharePoint Server Subscription Edition	Vulnerable	Yes — January 2026 Patch Tuesday
SharePoint Server 2019	Vulnerable	Yes — January 2026 Patch Tuesday
SharePoint Enterprise Server 2016	Vulnerable	Yes — January 2026 Patch Tuesday
SharePoint Server 2013 / 2010	Unsupported	No patch — end of support
SharePoint Online (Microsoft 365)	Not affected	N/A

This version profile — on-premises Server 2016, 2019, and Subscription Edition affected while SharePoint Online is not — is identical to the profile seen in the ToolShell campaign. Organizations that migrated to Microsoft 365 are not exposed through this particular flaw. Those maintaining self-hosted SharePoint deployments, especially internet-facing ones, carry the full risk.

The official CVSS score for CVE-2026-20963 is 8.8 (High), as assigned by the Microsoft Security Response Center and confirmed by Security Affairs. SecurityWeek initially referenced a score of 9.8; this likely reflects the unauthenticated, network-accessible attack vector which, under some scoring interpretations, can push a deserialization RCE into Critical range. The MSRC-assigned 8.8 is the authoritative figure. Regardless of the precise number, CISA's KEV catalog addition is the definitive operational signal: exploitation is confirmed and real, making the numeric score secondary to the remediation imperative.

03 / The CISA KEV Listing: What It Actually Means

The Known Exploited Vulnerabilities catalog is maintained by CISA under the authority granted by Binding Operational Directive 22-01, which was issued in November 2021. BOD 22-01 requires all Federal Civilian Executive Branch agencies to remediate vulnerabilities on the KEV list within specific timeframes after they are added. For CVE-2026-20963, CISA set the federal remediation deadline at March 21, 2026 — just three days after the catalog addition on March 18. That 72-hour window is among the tightest remediation deadlines CISA issues, and it signals genuine urgency about the severity and reach of active exploitation.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." CISA, Known Exploited Vulnerabilities Catalog entry for CVE-2026-20963, March 18, 2026

While BOD 22-01 applies exclusively to federal civilian agencies — departments such as Homeland Security, Justice, Energy, and State — CISA explicitly urges all organizations to treat the KEV catalog as a prioritization input for their own vulnerability management programs. The catalog is not a theoretical threat list. CISA's analysts add vulnerabilities only after obtaining verified evidence of active exploitation. By the time CVE-2026-20963 appeared in the catalog, attacks were already underway.

One notable detail: as of the catalog addition, Microsoft had not yet updated its own advisory for CVE-2026-20963 to acknowledge active exploitation. The Microsoft Security Response Center's exploitability assessment still listed the vulnerability as "exploitation less likely" even after CISA's March 18 listing — and a March 17 advisory update from Microsoft also did not mention active exploitation. Microsoft subsequently confirmed to SecurityWeek: "We addressed CVE-2026-20963 in our January Security Update. Customers who have installed the latest updates, or have automatic updates enabled, are already protected." This divergence — CISA confirming active exploitation while Microsoft's advisory had not yet been updated to reflect it — is not unprecedented, but it does illustrate why the KEV catalog has become an independent and authoritative source for defenders. CISA's catalog addition on March 18 was itself the first definitive public confirmation that exploitation was occurring.

Also added to the KEV catalog on March 18 was CVE-2025-66376 (CVSS 7.2), a stored cross-site scripting vulnerability in the Synacor Zimbra Collaboration Suite Classic UI, with a federal remediation deadline of April 1, 2026. The simultaneous addition of two actively exploited flaws in widely deployed enterprise collaboration platforms in a single catalog update underscores the breadth of the current threat environment.

04 / SharePoint's Vulnerability Pattern: Context That Cannot Be Ignored

CVE-2026-20963 does not exist in isolation. It is the latest entry in a multi-year pattern of deserialization vulnerabilities affecting on-premises SharePoint. Understanding that pattern is critical to understanding both the threat and what organizations need to do differently. The same nation-state actors documented in NoHacky's coverage of APT28's dual zero-day campaigns and APT41-linked espionage operations have established SharePoint as a recurring initial access vector.

The modern era of aggressive SharePoint exploitation began publicly at Pwn2Own Berlin in May 2025, when researchers from Viettel Cyber Security chained two vulnerabilities — an authentication bypass (CVE-2025-49706) and a deserialization RCE (CVE-2025-49704) — to achieve unauthenticated remote code execution. Microsoft patched both in the July 2025 Patch Tuesday release. What followed was a rapid deterioration of that patch coverage.

On July 18, 2025, Dutch security firm Eye Security identified mass exploitation of what appeared to be the already-patched Pwn2Own vulnerabilities. Further investigation revealed a previously unknown zero-day: CVE-2025-53770, a bypass of the July 8 patch. Attackers had discovered that by manipulating the HTTP Referer header to include /_layouts/SignOut.aspx, they could circumvent the authentication fix entirely, turning a patched vulnerability into a zero-day again. This bypass became the centerpiece of the ToolShell attack chain.

The scale of ToolShell exploitation was significant. According to Check Point Research, within days of public awareness, there were over 4,600 compromise attempts against more than 300 organizations globally. Attribution pointed to three Chinese state-sponsored groups, with Mandiant identifying at least one China-nexus group among the earliest attackers. Government agencies, telecommunications providers, healthcare organizations, and financial institutions across North America and Western Europe were among the confirmed targets.

The ToolShell campaign's post-exploitation methodology established a template that defenders must continue to watch for. After gaining initial code execution, attackers deployed ASPX web shells (commonly spinstall0.aspx) to the server's layouts directory, then used those shells to extract the server's ValidationKey and DecryptionKey. With those cryptographic keys in hand, attackers could forge valid ViewState payloads and maintain persistent access that survived both web shell removal and patch application.

CVE-2026-20963 follows the same fundamental weakness pattern as ToolShell: deserialization of untrusted data. While Microsoft has not publicly disclosed the precise exploit mechanics for CVE-2026-20963 — a deliberate choice that preserves short-term defensive advantage by limiting attacker knowledge — the class of vulnerability is identical. Defenders should assume that the post-exploitation playbook attackers have developed through ToolShell and prior campaigns applies here as well.

05 / Remediation: What Organizations Must Do Now

The remediation path for CVE-2026-20963 is straightforward in principle and non-negotiable in urgency. Microsoft released patches for all three affected versions as part of the January 2026 Patch Tuesday release cycle on January 13, 2026. Organizations that applied those updates two months ago are protected. Those that did not must act immediately.

The applicable security updates are available through Microsoft's Security Update Guide at msrc.microsoft.com. System administrators should verify patch application against the specific KB article numbers listed for each affected SharePoint version in that guide. Confirmation that the right knowledge base update has been applied — not just that some SharePoint update was installed — is the necessary verification step.

# Verify SharePoint patch level via PowerShell
Add-PSSnapin Microsoft.SharePoint.PowerShell
(Get-SPFarm).BuildVersion

# For SharePoint Subscription Edition, verify against
# January 2026 Patch Tuesday KB article numbers
# Source: Microsoft Security Update Guide - CVE-2026-20963

For organizations that cannot immediately apply the patch — a situation that should be rare given the two months of patch availability and the KEV listing — the following mitigations apply:

First, restrict network access to SharePoint servers. If the server does not need to be directly internet-accessible, place it behind a VPN, reverse proxy, or authenticated gateway such as Azure AD Application Proxy. Unauthenticated access from the public internet is the attack surface that CVE-2026-20963 exploits. Removing that access dramatically reduces exposure.

Second, ensure that Microsoft Defender Antivirus is deployed on all SharePoint servers and that the Antimalware Scan Interface (AMSI) integration with SharePoint is enabled and configured. Microsoft has indicated this combination blocks exploitation of network-based deserialization attacks in SharePoint environments. During the ToolShell campaign, AMSI integration proved effective as a temporary control while patches were applied.

Third, deploy Web Application Firewall rules specifically configured to detect and block common .NET deserialization payload signatures within HTTP POST requests. Tools like ysoserial.net generate payloads that carry recognizable structural signatures — WAF rules targeting Base64-encoded .NET gadget chain patterns in POST body content provide meaningful detection coverage even where deep packet inspection is unavailable.

Fourth, implement File Integrity Monitoring on the SharePoint layouts directory and IIS configuration files. Web shells dropped to these locations are a primary post-exploitation artifact, and detecting them rapidly is the difference between a contained incident and a full compromise including credential and machineKey exfiltration.

Fifth, as a precautionary measure even for patched systems, rotate the ASP.NET machineKey values on all SharePoint servers using the Update-SPMachineKey PowerShell cmdlet, followed by an IIS restart on all farm servers. If a server was compromised prior to patching — a possibility that cannot be ruled out given 65 days of potential exposure — key rotation is the mechanism that terminates the attacker's persistent forged-token access.

06 / Detection: What to Look For

Even patched organizations should conduct a retrospective hunt for indicators of prior compromise. The period between January 13, 2026 (when the patch was released) and March 18, 2026 (when active exploitation was confirmed) represents a window during which unpatched systems may have been targeted. Given the 65-day exposure window, any organization that did not apply the January 2026 patches promptly should treat this as an incident investigation, not just a patching exercise.

Key detection indicators drawn from historical SharePoint RCE campaigns include unusual process creation under w3wp.exe — particularly spawning of cmd.exe, powershell.exe, or csc.exe. Unexpected ASPX file creation in the SharePoint layouts directory, particularly files with names following patterns observed in prior campaigns, warrants immediate investigation. Anomalous outbound connections from IIS worker processes to external IP addresses indicate potential command-and-control activity. Log review should include both IIS access logs for unusual request patterns targeting SharePoint endpoints and Windows Event Logs for PowerShell execution and process creation events.

07 / The Broader Implication: On-Premises SharePoint as a Persistent Target

CVE-2026-20963 is a reminder that on-premises SharePoint occupies a uniquely dangerous position in the enterprise attack surface. SharePoint farms hold documents containing financial data, legal materials, human resources records, and sensitive operational information. They run integration workflows with other enterprise systems. Service accounts used by SharePoint often have broad permissions across the environment. A successful compromise is rarely limited to the SharePoint server itself — it is a gateway into the broader corporate network.

State-sponsored groups and ransomware operators have both recognized this reality. The ToolShell campaign demonstrated that nation-state actors will invest significant resources in developing and weaponizing SharePoint exploits. The rapid exploitation of newly patched vulnerabilities — often within weeks of patch release — indicates that adversaries maintain active research programs targeting SharePoint specifically. This pattern mirrors what NoHacky has documented in other enterprise platform campaigns, including the Interlock ransomware group's 36-day silent exploitation of a Cisco firewall zero-day and the 83 CVEs addressed in the March 2026 Patch Tuesday cycle, several of which were already under active exploitation at time of disclosure.

For security teams, the pattern demands a posture shift. Treating SharePoint patches as routine updates to be applied in the next quarterly maintenance window is no longer defensible. When Microsoft releases a SharePoint security update, the question is not whether exploitation will occur, but when. The gap between CVE-2026-20963's January 13 patch release and confirmed exploitation was 65 days. The gap for ToolShell was measured in days. Organizations that are still running unpatched January 2026 SharePoint updates today should consider their servers potentially compromised and begin incident response procedures alongside emergency patching.

"Since SharePoint servers often contain valuable corporate data and can also be used as a gateway to the entire corporate environment, SharePoint vulnerabilities are regularly leveraged by various attackers." Help Net Security, March 19, 2026

The KEV catalog listing for CVE-2026-20963 also arrives at a moment when the catalog itself has taken on renewed significance. With ten SharePoint entries now confirmed, defenders can no longer treat SharePoint deserialization vulnerabilities as an occasional anomaly. They represent a sustained and deliberate attack category. Organizations maintaining on-premises SharePoint should evaluate whether the security costs of that posture — in patching overhead, monitoring requirements, and exposure risk — remain justified compared to a migration to SharePoint Online, which is unaffected by this class of vulnerability.

08 / Key Takeaways

1. Patch immediately: The January 2026 Patch Tuesday updates addressing CVE-2026-20963 have been available since January 13, 2026. Any organization that has not applied them to SharePoint Server 2016, 2019, or Subscription Edition should treat this as an emergency patching event, not a scheduled maintenance item.
2. Assume prior compromise if unpatched: The 65-day window between patch release and confirmed active exploitation means that organizations running unpatched SharePoint may have already been compromised. Retrospective log review, ASPX file audits in the layouts directory, and machineKey rotation are essential steps alongside patching.
3. Enable AMSI and Defender AV on SharePoint servers: Microsoft's recommended compensating control — Antimalware Scan Interface integration with SharePoint paired with Defender Antivirus — provides meaningful protection for environments that cannot patch immediately and has proven effective against network-based deserialization exploitation in prior campaigns.
4. Restrict internet exposure: SharePoint servers that are directly accessible from the public internet without authentication carry the highest risk. Placing them behind authenticated gateways, VPNs, or reverse proxies removes the unauthenticated network attack vector that CVE-2026-20963 exploits.
5. Treat SharePoint patches as priority-one: The history of active, often state-sponsored exploitation of on-premises SharePoint vulnerabilities — now spanning at least ten KEV catalog entries — demands that security teams classify SharePoint security updates alongside operating system patches in terms of remediation urgency. The window between patch release and active exploitation for this class of vulnerability is shrinking with each new campaign.

The CISA KEV listing for CVE-2026-20963 carries a three-day federal remediation deadline. For private sector organizations, no regulatory clock is running — but the attackers who are actively exploiting this vulnerability are not waiting for quarterly patching windows either. The patch exists. The threat is confirmed. The action required is clear.