[Alert] SharePoint RCE Exploited: CISA Adds to KEV Catalog
Dillip Chowdary
March 24, 2026 • 6 min read
Microsoft and CISA have issued an urgent warning regarding CVE-2026-20963, a critical remote code execution (RCE) vulnerability in Microsoft SharePoint that is currently being exploited in the wild. The flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Deserialization: The Root Cause
The vulnerability is a deserialization flaw that allows a remote, authenticated attacker with Site Collection Administrator (SCA) privileges to execute arbitrary code on the underlying SharePoint server. While SCA privileges are required, attackers are known to use compromised credentials or lateral movement to gain the necessary access.
Once code execution is achieved, the attacker can move to sensitive document libraries, exfiltrate data, or deploy ransomware across the organizational intranet.
Immediate Action Required
- Patch Immediately: Apply the March 2026 cumulative updates for SharePoint Server 2016, 2019, and Subscription Edition.
- Audit SCA Privileges: Review all accounts with Site Collection Administrator rights and enforce MFA.
- Monitor for IOAs: Check for unusual process creation from the
w3wp.exeprocess.
Stay Organized During the Patch Cycle
Managing a massive patch cycle across enterprise infrastructure requires careful documentation and collaboration. Don't let critical steps fall through the cracks.
Track Your Security Tasks
Use ByteNotes to keep track of your patching progress, share technical notes with your team, and ensure every SharePoint instance is secured.
Organize with ByteNotes →Geopolitical Context
Threat intelligence reports suggest that the exploitation of CVE-2026-20963 is being driven by state-sponsored actors targeting government and financial sectors in the EMEA region. The speed at which this vulnerability moved from disclosure to active exploitation highlights the "machine-speed" nature of modern cyber warfare.