CVE-2026-20963 | CVSS 9.8 CRITICAL

Metadata

CVE ID: CVE-2026-20963
State: PUBLISHED
Assigner: microsoft
Reserved: 2025-12-04 20:04 UTC
Published: 2026-01-13 17:56 UTC
Last updated: 2026-04-02 03:55 UTC
Primary CWE: CWE-502
CWE-502: Deserialization of Untrusted Data
Vendor / Product: Microsoft / Microsoft SharePoint Enterprise Server 2016
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Vendor: Microsoft
Product: SharePoint
Added to KEV: 2026-03-18
Due date: 2026-03-21
Ransomware: Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA description

Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

Affected products (3)

Vendor	Product	Platform	Versions
Microsoft	Microsoft SharePoint Enterprise Server 2016	x64-based Systems	16.0.0 < 16.0.5535.1001
Microsoft	Microsoft SharePoint Server 2019	x64-based Systems	16.0.0 < 16.0.10417.20083
Microsoft	Microsoft SharePoint Server Subscription Edition	x64-based Systems	16.0.0 < 16.0.19127.20442

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502: Deserialization of Untrusted Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References (1)

Microsoft SharePoint Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963