CVE-2026-20963: Microsoft SharePoint deserialization flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, plus active exploitation indicated by KEV listing and high EPSS.

What it is

Microsoft SharePoint Server deserializes untrusted data, letting an unauthorized attacker run code over the network. The flaw is remotely reachable with no privileges or user interaction, and it is listed in CISA KEV, so it warrants urgent attention.

Impact

An attacker can execute arbitrary code on the SharePoint server, gaining full control of confidentiality, integrity and availability of the host and its data.

Attack surface

Reached over the network via the SharePoint service (AV:N) with no authentication (PR:N) and no user interaction (UI:N). Any internet- or intranet-exposed SharePoint endpoint is a candidate target.

Exploitation

CISA added it to KEV on 2026-03-18 with a 2026-03-21 remediation due date, indicating active exploitation; EPSS 30-day probability is 0.326 (98th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft SharePoint security update referenced in the MSRC advisory immediately.
• If patching is not possible, apply the vendor mitigations or take the affected SharePoint instance offline per CISA BOD 22-01 guidance.
• Restrict network exposure of SharePoint endpoints to trusted networks and require authentication where feasible.
• Monitor for and block deserialization payloads targeting SharePoint endpoints at the perimeter.
• Verify no unauthorized code or web shells were dropped before remediation.

Detection

• Hunt for anomalous w3wp.exe or SharePoint worker process spawning child processes such as cmd.exe, powershell.exe or scripting hosts.
• Review SharePoint ULS and IIS logs for unusual POST requests or serialized payload patterns to SharePoint endpoints.
• Alert on new or modified files under SharePoint web directories and the bin folder.
• Correlate outbound network connections from SharePoint servers to unknown external hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.