SharePoint CVE-2026-20963: January RCE, Exploited by March

What to do

1. Run (Get-SPFarm).BuildVersion on a farm server and compare it with both the January 2026 and the August 2026 builds.
2. Install the latest SharePoint security update for your version, at least the August 2026 packages, then run PSConfig on each server.
3. Enable AMSI in Full Mode and run EDR on SharePoint servers, as CERT-EU advises.
4. Rotate the ASP.NET machine keys and restart IIS with iisreset.exe, especially if the farm was internet-facing before patching.
5. If a farm cannot be patched at once, isolate it from the internet, as NCSC New Zealand suggests.
6. Upgrade any out-of-support SharePoint version to a supported, patched release.

How to check if you are affected or compromised

• Look for w3wp.exe launching cmd.exe, powershell.exe or net.exe on SharePoint servers.
• Search SharePoint web directories for unexpected .aspx, .ashx or .asmx files.
• Review IIS logs from January to March 2026 for unusual POST requests from unknown addresses, since no official indicators exist.
• Run a compromise assessment on internet-facing farms, as CERT-EU recommends, and preserve logs before rotating keys or rebuilding.

What happened#

On January 13, 2026, Microsoft's Patch Tuesday fixed CVE-2026-20963, a deserialization flaw in on-premises SharePoint Server. The Microsoft advisory says the flaw "allows an unauthorized attacker to execute code over a network." Microsoft rated exploitation "less likely" and credits only anonymous researchers. The fixes shipped as KB5002822, KB5002825 and KB5002828.

On March 17, Microsoft revised the entry. The revision log says it "Updated the CVSS score and corrected FAQs." The score is now 9.8, with no privileges or user interaction required. The FAQ now says "an unauthenticated attacker could write arbitrary code to inject and execute code remotely." The next day CISA added the bug to its KEV catalog. It gave federal agencies until March 21, only three days.

The attacks themselves are undocumented. SecurityWeek found no public information about them. Microsoft told it that "Customers who have installed the latest updates, or have automatic updates enabled, are already protected." Help Net Security noted that no user interaction is needed. Beazley Security says neither CISA nor Microsoft has released indicators. As of Oct 23, 2026, attackers and victims are still not disclosed, KEV lists ransomware use as unknown, and Microsoft's guide still reads "Exploited: No."

Who is affected#

Per the CVE record and NVD, the affected products are SharePoint Enterprise Server 2016 before 16.0.5535.1001, SharePoint Server 2019 before 16.0.10417.20083, and Subscription Edition before 16.0.19127.20442. SharePoint Online is not listed. NCSC New Zealand warns that end-of-life SharePoint versions may also be affected.

Do you really need to act?#

For this CVE alone, most farms patched in January or soon after the KEV listing, so the verdict is check exposure. But "patched for this one" is not enough. Since March, CISA has added seven more SharePoint bugs to KEV: CVE-2026-32201 in April, CVE-2026-45659 on July 1 (marked as used by ransomware), CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522 in July, CVE-2026-55040 in August, and CVE-2026-65660 on September 25. Separate briefs cover the summer bugs. A farm that took the January update and stopped there is open to all of them. The newest fixed builds among them come from the August 2026 updates: 16.0.19725.20522 for Subscription Edition, 16.0.10417.20198 for 2019 and 16.0.5565.1001 for 2016, per the CVE-2026-65660 record. Treat those as the floor.

The other question is the window. A farm that was reachable from the internet and unpatched in early 2026 may have been hit before the fix went on. A later update does not remove a web shell or stolen machine keys.

What to do now#

1. On a farm server, run (Get-SPFarm).BuildVersion and compare it with the builds above.
2. Install the latest security update for your version, at least the August 2026 packages, then run PSConfig on each server.
3. Follow CERT-EU: enable AMSI in Full Mode, run EDR, rotate the ASP.NET machine keys, and restart IIS with iisreset.exe.
4. If you cannot patch at once, isolate SharePoint from the internet, as NCSC New Zealand suggests.
5. Upgrade any out-of-support SharePoint version.

How to tell if you were hit#

No indicators have been published for this CVE. Beazley suggests watching for w3wp.exe launching cmd.exe, powershell.exe or net.exe, and for unexpected .aspx, .ashx or .asmx files in SharePoint web directories. Review IIS logs from January to March 2026 for unusual POST requests from unknown addresses. CERT-EU also recommends a compromise assessment on internet-facing servers. If you find anything, preserve logs before you rotate keys or rebuild.

Timeline#

• Jan 13, 2026 — Microsoft fixes CVE-2026-20963 and rates exploitation less likely.
• Mar 17, 2026 — Microsoft revises the CVSS score and FAQ.
• Mar 18, 2026 — CISA adds the CVE to KEV.
• Mar 21, 2026 — Federal remediation deadline.
• Mar 25, 2026 — CERT-EU publishes advisory 2026-004.
• Sep 25, 2026 — CVE-2026-65660 becomes the seventh later SharePoint bug added to KEV.

Vulnerability records

• CVE-2026-20963 · KEV 2026-03-18 · Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Update Guide: CVE-2026-20963, Microsoft SharePoint Remote Code Execution Vulnerability msrc.microsoft.com
2. CVE record — CVE-2026-20963 cve.org
3. NVD — CVE-2026-20963 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-20963 cisa.gov
5. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Mar 18, 2026) cisa.gov
6. CVE record — CVE-2026-65660 (latest fixed SharePoint builds among KEV entries) cve.org
7. CERT-EU — Security Advisory 2026-004: Critical Vulnerability in SharePoint Exploited cert.europa.eu
8. NCSC New Zealand — CVE-2026-20963 affecting SharePoint Server ncsc.govt.nz
9. Beazley Security — Critical Vulnerability in Microsoft SharePoint Under Active Exploitation (CVE-2026-20963) beazley.security

Coverage and analysis

1. SecurityWeek — CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability securityweek.com
2. Help Net Security — CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) helpnetsecurity.com