CVE-2026-20963
Known exploited · CISA KEV
CVSS 8.8 HIGH: deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a… EPSS 29% (98th percentile).
CISA federal remediation date Mar 21
Vulnerabilities · 225 days ago
A critical remote-code-execution flaw in Microsoft SharePoint (CVE-2026-20963) is being exploited in the wild. Microsoft released fixes in January 2026 for SharePoint Server 2016, 2019, and Subscription Edition.
Known exploited · CISA KEV
CVSS 8.8 HIGH: deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a… EPSS 29% (98th percentile).
CISA federal remediation date Mar 21
3 sources covering this story
CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers.
CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability
The SharePoint remote code execution vulnerability CVE-2026-20963, which Microsoft patched in January, has been exploited in the wild.
Critical Microsoft SharePoint flaw now exploited in attacks
A critical Microsoft SharePoint vulnerability patched in January is now being exploited in attacks, the Cybersecurity and Infrastructure Security Agency (CISA) warned.
Part of the PlainSec briefing for 2026-03-24