Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jan 13, 2026 · Catalog

   Detected

   Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

2. Mar 18, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Mar 21, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

Affected

• cpe microsoft/sharepoint serverversion unspecified
• cpe microsoft/sharepoint server2016
• cpe microsoft/sharepoint server2019
• vendor Microsoft SharePointversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2026-20963

  Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-20963

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-20963

  30-day exploitation probability 29.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-20963

  Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  nvd.nist.gov

References

• CISA note · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov