What’s Vulnerable › Vulnerabilities

CVE-2026-20963: Microsoft SharePoint Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-03-18
• EPSS: 29.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-07-30
• Weakness: CWE-502

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Summary

CVE-2026-20963 is a critical deserialization of untrusted data flaw in Microsoft SharePoint Server that lets an unauthenticated attacker execute code over the network (CVSS 9.8). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 29.2% chance of exploitation in the next 30 days. SharePoint Server is affected; the issue is fixed in version 16.0.19127.20442. Apply the vendor update or mitigations immediately, follow BOD 22-01 guidance for cloud services, and discontinue use if no mitigation is available.

CVE-2026-20963 ثغرة حرجة من نوع إزالة تسلسل البيانات غير الموثوقة في Microsoft SharePoint Server، وتسمح لمهاجم غير مصرح له بتنفيذ تعليمات برمجية عبر الشبكة (CVSS 9.8). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها فعلياً، وتقدّر EPSS احتمال استغلالها خلال 30 يوماً بنسبة 29.2%. المنتج المتأثر هو SharePoint Server، وتم إصلاحها في الإصدار 16.0.19127.20442. يجب تطبيق تحديث المورّد أو التخفيفات فوراً، واتباع إرشادات BOD 22-01 للخدمات السحابية، وإيقاف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Microsoft SharePoint Server: before 16.0.19127.20442; 2016, 2019 — fixed in 16.0.19127.20442
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.19127.20442 — fixed in 16.0.19127.20442
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5535.1001 — fixed in 16.0.5535.1001
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20083 — fixed in 16.0.10417.20083

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.19127.20442; Microsoft SharePoint Server Subscription Edition 16.0.19127.20442; Microsoft Sharepoint Enterprise Server 2016 16.0.5535.1001; Microsoft SharePoint Server 16.0.10417.20083. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963

Get alerted when CVE-2026-20963 or the next vulnerability affects your stack