Active Exploitation of Microsoft SharePoint CVE-2026-20963

Affected Environment
Microsoft SharePoint Server 2016, 2019, and Subscription Edition are affected if not updated to the specified secure versions. Exposure exists where these SharePoint servers remain unpatched and reachable over the network inside or outside the organisation.

Threat Overview
CVE-2026-20963 is a high severity SharePoint flaw now under active exploitation for remote code execution. An unauthorised attacker can run code over the network, enabling further payloads, persistence, and lateral movement.

Exposure Timeline
Microsoft issued patches for this vulnerability on 13 January 2026 as part of Patch Tuesday. Active exploitation was reported as of 19 March 2026, increasing risk for any still-unpatched SharePoint servers.

Attack Surface
The primary attack surface is vulnerable, network-accessible Microsoft SharePoint servers in affected versions. Both internet-facing and internally exposed SharePoint instances may be targeted if an attacker can reach them.

Technical Root Cause
The root cause is unsafe deserialization of untrusted data within Microsoft SharePoint. SharePoint fails to correctly validate data before re-creating objects in memory, enabling execution of embedded code.

Exploitation Pathway
An attacker sends a crafted data packet to a vulnerable SharePoint server, which deserializes it without proper checks. This process can execute attacker-controlled instructions, enabling deployment of secondary payloads and backdoors.