CISA KEV: Microsoft SharePoint RCE Vulnerability (CVE-2026-20963)

CISA Known Exploited Vulnerabilities (KEV)

Published March 18th, 2026

Detected March 19th, 2026

Summary

CISA has added a Microsoft SharePoint remote code execution vulnerability (CVE-2026-20963) to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability has a CVSS score of 8.8 and is actively exploited.

View original document View source feed page

What changed

CISA has officially added CVE-2026-20963, a critical remote code execution vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, identified by Microsoft Corporation and rated with a CVSS score of 8.8 (HIGH), stems from deserialization of untrusted data and allows an authenticated attacker to execute code over a network. This inclusion signifies that the vulnerability is actively exploited in the wild, posing a significant risk.

Federal agencies are mandated to apply security updates or mitigations by March 18, 2026, to protect against this threat. Other organizations using Microsoft SharePoint should prioritize patching or implementing workarounds immediately to prevent potential exploitation, which could lead to network compromise and further attacks. Failure to comply with CISA directives may result in security incidents and potential repercussions.

What to do next

Apply security updates or mitigations for CVE-2026-20963 on all Microsoft SharePoint instances.
Review CISA's KEV catalog for active exploitation details and recommended actions.
Implement enhanced monitoring for suspicious activity related to SharePoint.

Source document (simplified)

Required CVE Record Information

CNA: Microsoft Corporation

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CWE 1 Total

Learn more
- CWE-502: CWE-502: Deserialization of Untrusted Data

CVSS 1 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.8 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |

Product Status

Learn more Versions 1 Total

Default Status: unknown

affected

affected from 16.0.0 before 16.0.5535.1001 Versions 1 Total

Default Status: unknown

affected

affected from 16.0.0 before 16.0.10417.20083 Versions 1 Total

Default Status: unknown

affected

affected from 16.0.0 before 16.0.19127.20442

References 1 Total

msrc.microsoft.com: Microsoft SharePoint Remote Code Execution Vulnerability vendor-advisory patch

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-03-19

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | total | 2.0.3 | 2026-01-08 |