Microsoft confirms active exploitation of SharePoint RCE (CVE-2026-20963). CISA urges immediate patching to prevent deserialization attacks. Secure your data.
What this alert covers
Microsoft has confirmed active exploitation of a remote code execution (RCE) flaw in SharePoint, tracked as CVE-2026-20963. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and is urging immediate patching. The attack path centers on unsafe deserialization: attackers send crafted input that the server treats as trusted objects, then use that path to run code with the application’s privileges.
RCE in SharePoint is high impact because the product often sits inside the trust boundary of file stores, identity integrations, and internal workflows. A successful exploit can mean more than a single compromised web process—it can mean access to documents, service accounts, and lateral movement into adjacent systems. KEV listing is CISA’s signal that this is not theoretical risk; exploitation is underway and organizations should treat remediation as urgent work, not a backlog item.
Why deserialization RCE is dangerous
Deserialization bugs appear when an application reconstructs objects from untrusted data without strict type and content controls. If the runtime can be steered into instantiating dangerous types or invoking unintended methods, the attacker effectively gains a code path on the server. In web platforms like SharePoint, those entry points may sit behind authenticated surfaces, or they may be reachable more broadly depending on exposure and configuration.
Once code execution is achieved, defenders should assume the attacker can read local configuration, harvest tokens or credentials available to the process, and plant persistence. SharePoint environments often hold sensitive collaboration data and connect to directories, mail, and line-of-business apps. That combination turns a single RCE into a data-security and business-continuity problem, not only a patch ticket.
Immediate actions for operators
- Apply Microsoft’s security updates for affected SharePoint deployments as soon as change control allows—prefer emergency windows over waiting for the next routine cycle.
- Inventory internet-facing and partner-facing SharePoint instances first; reduce exposure where full patching cannot land immediately.
- Review authentication, service accounts, and privileged roles bound to SharePoint; rotate secrets if you suspect compromise or if logs show anomalous access.
- Hunt for unusual process launches, new web shells or unexpected files under web roots, and abnormal outbound connections from SharePoint hosts.
- Confirm backup integrity for site collections and configuration so recovery remains an option if containment fails.
Patching closes the known entry, but it does not undo prior intrusion. Pair the update with log review for the period before the fix landed, and with checks for persistence that would survive a simple service restart. If your organization falls under CISA’s federal or related directives that reference KEV timelines, map this CVE into that compliance track so remediation deadlines are explicit rather than informal.
Hardening after the emergency fix
After systems are patched and you have no evidence of active compromise, tighten the long-term posture. Prefer least privilege for application pools and service identities so a future RCE cannot immediately become domain-level control. Segment SharePoint management interfaces, limit who can deploy custom code or solutions, and keep deserialization and other untrusted-input surfaces behind strong auth and network controls where architecture allows.
Treat this incident as a prompt to validate your vulnerability pipeline: subscription to vendor advisories, mapping of SharePoint roles to owners, and a tested path from “CISA KEV alert” to “patched and verified.” For data protection, ensure encryption at rest, access reviews on high-value libraries, and monitoring that surfaces bulk download or unusual sharing patterns. Secure your data by assuming RCE is a path to content exfiltration until hunting proves otherwise—and by keeping patching, detection, and recovery ready for the next actively exploited flaw.