---
title: "SharePoint CVE-2026-20963: January RCE, Exploited by March"
url: https://erroneo.us/security/briefs/sharepoint-cve-2026-20963-deserialization-rce/
description: "A January 2026 on-prem SharePoint deserialization RCE was rescored to 9.8 and added to KEV in March. Seven later SharePoint KEV bugs make August 2026 the floor."
type: security-brief
section: "Security Digest"
date_published: 2026-01-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-20963"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SharePoint CVE-2026-20963: January RCE, Exploited by March

**Verdict: Check exposure.** Fixed in January 2026 and exploited by March; a farm on the August 2026 builds or later is covered, but any farm that was internet-facing and unpatched in early 2026 needs a compromise check, not just an update.

- **Who must act:** Admins of on-premises SharePoint Server 2016, 2019 or Subscription Edition below the August 2026 builds, and anyone whose farm was reachable from the internet before the January 2026 update.
- **Who can relax:** SharePoint Online customers, which the advisory does not list, and farms already on the August 2026 builds or later that show no signs of compromise.
- **Affected:** SharePoint Enterprise Server 2016 before 16.0.5535.1001; SharePoint Server 2019 before 16.0.10417.20083; SharePoint Server Subscription Edition before 16.0.19127.20442; Out-of-support SharePoint versions may also be affected, per NCSC New Zealand
- **Fixed:** Subscription Edition 16.0.19127.20442 (KB5002822, Jan 13, 2026); SharePoint Server 2019 16.0.10417.20083 (KB5002825); SharePoint Enterprise Server 2016 16.0.5535.1001 (KB5002828); Recommended floor because of later KEV bugs: Subscription Edition 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001 (August 2026)
- **CVEs:** CVE-2026-20963
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run (Get-SPFarm).BuildVersion on a farm server and compare it with both the January 2026 and the August 2026 builds.
2. Install the latest SharePoint security update for your version, at least the August 2026 packages, then run PSConfig on each server.
3. Enable AMSI in Full Mode and run EDR on SharePoint servers, as CERT-EU advises.
4. Rotate the ASP.NET machine keys and restart IIS with iisreset.exe, especially if the farm was internet-facing before patching.
5. If a farm cannot be patched at once, isolate it from the internet, as NCSC New Zealand suggests.
6. Upgrade any out-of-support SharePoint version to a supported, patched release.

### How to check if you are affected

- Look for w3wp.exe launching cmd.exe, powershell.exe or net.exe on SharePoint servers.
- Search SharePoint web directories for unexpected .aspx, .ashx or .asmx files.
- Review IIS logs from January to March 2026 for unusual POST requests from unknown addresses, since no official indicators exist.
- Run a compromise assessment on internet-facing farms, as CERT-EU recommends, and preserve logs before rotating keys or rebuilding.

## What happened

On January 13, 2026, Microsoft's Patch Tuesday fixed CVE-2026-20963, a deserialization flaw in on-premises SharePoint Server. The [Microsoft advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963) says the flaw "allows an unauthorized attacker to execute code over a network." Microsoft rated exploitation "less likely" and credits only anonymous researchers. The fixes shipped as KB5002822, KB5002825 and KB5002828.

On March 17, Microsoft revised the entry. The revision log says it "Updated the CVSS score and corrected FAQs." The score is now 9.8, with no privileges or user interaction required. The FAQ now says "an unauthenticated attacker could write arbitrary code to inject and execute code remotely." The next day CISA [added the bug](https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog-0) to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963). It gave federal agencies until March 21, only three days.

The attacks themselves are undocumented. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-attacks-exploiting-recent-sharepoint-vulnerability/) found no public information about them. Microsoft told it that "Customers who have installed the latest updates, or have automatic updates enabled, are already protected." [Help Net Security](https://www.helpnetsecurity.com/2026/03/19/sharepoint-vulnerability-cve-2026-20963-exploited/) noted that no user interaction is needed. [Beazley Security](https://beazley.security/alerts-advisories/critical-vulnerability-in-microsoft-sharepoint-under-active-exploitation-cve-2026-20963) says neither CISA nor Microsoft has released indicators. As of Oct 23, 2026, attackers and victims are still not disclosed, KEV lists ransomware use as unknown, and Microsoft's guide still reads "Exploited: No."

## Who is affected

Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-20963) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20963), the affected products are SharePoint Enterprise Server 2016 before 16.0.5535.1001, SharePoint Server 2019 before 16.0.10417.20083, and Subscription Edition before 16.0.19127.20442. SharePoint Online is not listed. [NCSC New Zealand](https://www.ncsc.govt.nz/alerts/cve-2026-20963-affecting-sharepoint-server/) warns that end-of-life SharePoint versions may also be affected.

## Do you really need to act?

For this CVE alone, most farms patched in January or soon after the KEV listing, so the verdict is check exposure. But "patched for this one" is not enough. Since March, CISA has added seven more SharePoint bugs to KEV: CVE-2026-32201 in April, CVE-2026-45659 on July 1 (marked as used by ransomware), CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522 in July, CVE-2026-55040 in August, and CVE-2026-65660 on September 25. Separate briefs cover the summer bugs. A farm that took the January update and stopped there is open to all of them. The newest fixed builds among them come from the August 2026 updates: 16.0.19725.20522 for Subscription Edition, 16.0.10417.20198 for 2019 and 16.0.5565.1001 for 2016, per the [CVE-2026-65660 record](https://www.cve.org/CVERecord?id=CVE-2026-65660). Treat those as the floor.

The other question is the window. A farm that was reachable from the internet and unpatched in early 2026 may have been hit before the fix went on. A later update does not remove a web shell or stolen machine keys.

## What to do now

1. On a farm server, run `(Get-SPFarm).BuildVersion` and compare it with the builds above.
2. Install the latest security update for your version, at least the August 2026 packages, then run `PSConfig` on each server.
3. Follow [CERT-EU](https://cert.europa.eu/publications/security-advisories/2026-004/): enable AMSI in Full Mode, run EDR, rotate the ASP.NET machine keys, and restart IIS with `iisreset.exe`.
4. If you cannot patch at once, isolate SharePoint from the internet, as NCSC New Zealand suggests.
5. Upgrade any out-of-support SharePoint version.

## How to tell if you were hit

No indicators have been published for this CVE. Beazley suggests watching for `w3wp.exe` launching `cmd.exe`, `powershell.exe` or `net.exe`, and for unexpected `.aspx`, `.ashx` or `.asmx` files in SharePoint web directories. Review IIS logs from January to March 2026 for unusual POST requests from unknown addresses. CERT-EU also recommends a compromise assessment on internet-facing servers. If you find anything, preserve logs before you rotate keys or rebuild.

## Timeline

- Jan 13, 2026 — Microsoft fixes CVE-2026-20963 and rates exploitation less likely.
- Mar 17, 2026 — Microsoft revises the CVSS score and FAQ.
- Mar 18, 2026 — CISA adds the CVE to KEV.
- Mar 21, 2026 — Federal remediation deadline.
- Mar 25, 2026 — CERT-EU publishes advisory 2026-004.
- Sep 25, 2026 — CVE-2026-65660 becomes the seventh later SharePoint bug added to KEV.

## Sources

1. [Microsoft — Security Update Guide: CVE-2026-20963, Microsoft SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963)
2. [CVE record — CVE-2026-20963](https://www.cve.org/CVERecord?id=CVE-2026-20963)
3. [NVD — CVE-2026-20963](https://nvd.nist.gov/vuln/detail/CVE-2026-20963)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-20963](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963)
5. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Mar 18, 2026)](https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog-0)
6. [CVE record — CVE-2026-65660 (latest fixed SharePoint builds among KEV entries)](https://www.cve.org/CVERecord?id=CVE-2026-65660)
7. [CERT-EU — Security Advisory 2026-004: Critical Vulnerability in SharePoint Exploited](https://cert.europa.eu/publications/security-advisories/2026-004/)
8. [NCSC New Zealand — CVE-2026-20963 affecting SharePoint Server](https://www.ncsc.govt.nz/alerts/cve-2026-20963-affecting-sharepoint-server/)
9. [Beazley Security — Critical Vulnerability in Microsoft SharePoint Under Active Exploitation (CVE-2026-20963)](https://beazley.security/alerts-advisories/critical-vulnerability-in-microsoft-sharepoint-under-active-exploitation-cve-2026-20963)
10. [SecurityWeek — CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-attacks-exploiting-recent-sharepoint-vulnerability/)
11. [Help Net Security — CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)](https://www.helpnetsecurity.com/2026/03/19/sharepoint-vulnerability-cve-2026-20963-exploited/)

---
Source page: https://erroneo.us/security/briefs/sharepoint-cve-2026-20963-deserialization-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt