CISA Warns of Recent SharePoint Vulnerability Attacks: Protect Your Network
Critical Vulnerability in Microsoft SharePoint Actively Exploited
A critical vulnerability in Microsoft SharePoint has been actively exploited by attackers, according to a warning from the Cybersecurity and Infrastructure Security Agency (CISA). The flaw, identified as CVE-2026-20963, was patched by Microsoft in January 2026 as part of its monthly Patch Tuesday updates.
Vulnerability Details
CVE-2026-20963 is a remote code execution vulnerability that arises from the deserialization of untrusted data. It affects SharePoint Server 2016, 2019, and Subscription Edition, and is considered critical, with a CVSS score of 9.8. An anonymous researcher reported the issue to Microsoft.
Exploitation and Mitigation
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on March 18, instructing federal agencies to address it by March 21.
Additional Context
CISA’s KEV catalog currently includes nine SharePoint vulnerabilities, including three disclosed in 2025 that were associated with the ToolShell attacks. The agency’s warning serves as a reminder to organizations to prioritize patching and vulnerability management to prevent exploitation by attackers.
Recommendations
The exploitation of CVE-2026-20963 highlights the importance of timely patching and vulnerability management. Organizations should ensure that they have applied the necessary patches to prevent exploitation of this critical vulnerability.
About Author
English