CISA Warns of Microsoft SharePoint Vulnerability Exploited in Attacks

Key Takeaways

• A critical deserialization vulnerability in Microsoft SharePoint, identified as CVE-2026-20963, is under active exploitation.
• The flaw allows unauthenticated remote code execution, posing a severe risk to sensitive enterprise data.
• CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating rapid patching for federal agencies.
• All organizations using Microsoft SharePoint are urged to apply vendor-supplied patches or mitigations immediately.

A significant security flaw affecting Microsoft SharePoint is now being actively exploited by threat actors, prompting its inclusion in the Known Exploited Vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA) on March 18, 2026. This move confirms that malicious actors are leveraging the vulnerability in real-world attacks, necessitating immediate action from all organizations utilizing the collaboration platform.

The Deserialization Flaw: CVE-2026-20963

The vulnerability, tracked as CVE-2026-20963, originates from an improper handling of untrusted data deserialization within Microsoft SharePoint. Deserialization is a critical process where an application converts data from a stored or transmitted format back into executable objects within its memory. When an application fails to adequately validate the safety of this incoming data, it creates an opportunity for attackers.

In the case of CVE-2026-20963, an unauthenticated remote attacker can craft a specially designed malicious data packet and transmit it over the network to a vulnerable SharePoint server. When SharePoint attempts to deserialize this tainted input, it inadvertently executes the attacker’s embedded instructions. This allows the threat actor to achieve arbitrary code execution on the host machine without needing any valid user credentials.

Impact and Exploitation

Given that SharePoint environments frequently store highly sensitive corporate documents and facilitate internal communications, a successful remote code execution attack could lead to a catastrophic data breach. The active exploitation observed by CISA underscores the urgency of this threat, though the specific advanced persistent threat (APT) groups behind these campaigns have not yet been identified.

While CISA has not confirmed the vulnerability’s involvement in active ransomware campaigns, remote code execution flaws are highly coveted by initial access brokers and ransomware syndicates. Such vulnerabilities provide a critical foothold, enabling attackers to deploy secondary payloads, establish persistent backdoors, and move laterally across an organization’s network to initiate extortion campaigns or other malicious activities.

What You Should Do

CISA has issued stringent directives for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 22-01, mandating that all vulnerable Microsoft SharePoint instances be patched or mitigated by March 21, 2026. Private-sector organizations are strongly advised to adopt this aggressive timeline to safeguard their digital infrastructure.

• Immediately Apply Updates: Review Microsoft’s official security advisories and apply all available security updates and patches for SharePoint without delay.
• Implement Mitigations: If immediate patching is not feasible, apply any vendor-supplied mitigations as an interim measure.
• Discontinue Use: If no alternative mitigations are available, CISA explicitly recommends discontinuing the use of the vulnerable product until a permanent fix can be safely implemented.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.