CISA Adds Microsoft SharePoint and Zimbra Vulnerabilities to KEV Catalog
Active Exploitation · 5 sources · Updated 4mo ago · First seen Mar 18, 2026
CISA added two newly tracked flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20963 in Microsoft SharePoint and CVE-2025-66376 in Synacor Zimbra Collaboration Suite. The SharePoint issue is a deserialization of untrusted data vulnerability, mapped to CWE-502, that can allow code execution over the network; CISA’s KEV entry describes it as enabling an unauthorized attacker to execute code remotely. The Zimbra issue is a stored cross-site scripting flaw in the Classic UI, mapped to CWE-79, in which attackers can abuse CSS @import directives in email HTML.
CISA’s KEV update requires federal civilian executive branch agencies to remediate the SharePoint flaw by 2026-03-21 and the Zimbra flaw by 2026-04-01, or follow applicable mitigation guidance under BOD 22-01. The GitHub KEV data commit confirms both additions and records the required actions as applying vendor mitigations, following cloud-service guidance where relevant, or discontinuing use if mitigations are unavailable. The reporting also notes that, while the KEV catalog is binding on federal agencies, private organizations should review the catalog and prioritize these vulnerabilities because CISA has identified them as actively exploited.
