EXPOSURES › CVE-2026-20963
CVE-2026-20963
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft SharePoint allows remote code execution via deserialization of untrusted data, confirmed as actively exploited.
This vulnerability enables an attacker to execute arbitrary code on Microsoft SharePoint servers by deserializing untrusted data, posing a severe risk to DIB organizations relying on SharePoint for sensitive data. Because it is actively exploited and linked to ransomware campaigns, organizations must immediately patch and review SharePoint configurations to prevent unauthorized access and data exfiltration.
Shame score — Active exploitation of a critical RCE vulnerability in a widely used product indicates a severe security posture failure.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |