Microsoft updated its advisory to confirm CVE-2026-20963 is an unauthenticated remote code execution flaw in SharePoint. The bug is CVSS 9.8, was added to CISA's Known Exploited Vulnerabilities list, and Microsoft patched it along with three other SharePoint RCEs in March 2026.
CVSS 8.8 HIGH: deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a… EPSS 29% (98th percentile).
CISA federal remediation date Mar 21 · date passed
CVSS 8.8 HIGH: deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a… EPSS 3% (88th percentile). Microsoft patch: 5002850.
CVSS 8.8 HIGH: improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. EPSS 1% (73rd percentile). Microsoft patch: 5002850.