Loading story…
CISA added CVE-2026-20963, a Microsoft SharePoint deserialization flaw, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The vulnerability allows an unauthorized remote attacker to execute arbitrary code over the network by sending crafted serialized data that SharePoint improperly deserializes, creating a pre-authentication remote code execution path. Reporting indicates the specific threat actors behind the attacks have not been publicly identified, but the flaw affects a widely deployed enterprise collaboration platform that often stores sensitive internal documents and communications.
The KEV entry triggered urgent remediation requirements, including a March 21, 2026 deadline for FCEB agencies under Binding Operational Directive 22-01. Additional reporting notes that the same KEV update also included vulnerabilities in Wing FTP Server and Synacor Zimbra Collaboration Suite, but the SharePoint issue stands out because of its likely value for initial access brokers and ransomware affiliates seeking enterprise footholds. Organizations using SharePoint should treat internet-exposed systems as high priority for patching and review for signs of compromise given confirmed in-the-wild exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In the same March 2026 KEV update, CISA also added CVE-2025-47813 in Wing FTP Server and CVE-2025-66376 in Synacor Zimbra Collaboration Suite, confirming active exploitation of both vulnerabilities. The Wing FTP issue is an information disclosure flaw that can support exploitation chains, while the Zimbra issue is a stored XSS bug in the Classic UI.
Following the KEV listing, CISA directed Federal Civilian Executive Branch agencies to patch or mitigate CVE-2026-20963 under Binding Operational Directive 22-01. The agency set a March 21, 2026 deadline, an unusually short three-day remediation window reflecting the urgency of the risk.
On March 18, 2026, CISA added the Microsoft SharePoint vulnerability CVE-2026-20963 to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The flaw is a deserialization issue that can allow unauthenticated remote code execution on vulnerable SharePoint servers.
Microsoft fixed CVE-2026-20963 in its January 2026 Patch Tuesday updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. At the time, Microsoft reportedly assessed the vulnerability as less likely to be exploited and not publicly known or exploited.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cert.europa.eu
Open sourcelearn.microsoft.com
Open sourcecybersecuritynews.com
Open sourcethecyberthrone.in
Open sourcehelpnetsecurity.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **`CVE-2026-45659`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a high-severity remote code execution flaw in on-premises **Microsoft SharePoint Server**. The vulnerability stems from **deserialization of untrusted data** (`CWE-502`) and carries a **CVSS 8.8** score. It affects **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** below patched versions, and can be exploited over the network by an authenticated attacker with low privileges such as **Site Member**, without user interaction. Microsoft issued fixes in its **May 2026** security updates, later clarifying that the CVE had been inadvertently omitted from the initial update list. CISA set a **July 4, 2026** remediation deadline for federal civilian agencies under Binding Operational Directive 22-01, while public reporting said the exact vulnerable SharePoint component, gadget chain, payload delivery method, and any connection to ransomware activity had not yet been disclosed. Security guidance accompanying the KEV listing urged organizations to patch immediately and review exposed SharePoint environments for signs of compromise.
Jul 10, 2026
**CISA** added two newly tracked flaws to its **Known Exploited Vulnerabilities (KEV)** catalog: **CVE-2026-20963** in **Microsoft SharePoint** and **CVE-2025-66376** in **Synacor Zimbra Collaboration Suite**. The SharePoint issue is a deserialization of untrusted data vulnerability, mapped to `CWE-502`, that can allow code execution over the network; CISA’s KEV entry describes it as enabling an unauthorized attacker to execute code remotely. The Zimbra issue is a stored cross-site scripting flaw in the Classic UI, mapped to `CWE-79`, in which attackers can abuse CSS `@import` directives in email HTML. CISA’s KEV update requires federal civilian executive branch agencies to remediate the SharePoint flaw by **2026-03-21** and the Zimbra flaw by **2026-04-01**, or follow applicable mitigation guidance under **BOD 22-01**. The GitHub KEV data commit confirms both additions and records the required actions as applying vendor mitigations, following cloud-service guidance where relevant, or discontinuing use if mitigations are unavailable. The reporting also notes that, while the KEV catalog is binding on federal agencies, private organizations should review the catalog and prioritize these vulnerabilities because CISA has identified them as actively exploited.
Jun 29, 2026
CISA added **`CVE-2026-45659`** to its Known Exploited Vulnerabilities catalog after confirming active attacks against Microsoft SharePoint Server. The high-severity flaw is a **deserialization of untrusted data** issue that lets an authenticated attacker with only **Site Member** permissions execute arbitrary code on vulnerable, internet-exposed servers, with no user interaction required and low attack complexity. Microsoft said the bug is easy to exploit with repeatable success and released fixes in late May after the CVE was initially omitted from its May 2026 security updates. The vulnerability affects **SharePoint Server Subscription Edition**, **SharePoint Server 2019**, **SharePoint Server 2016**, and **SharePoint Enterprise Server 2016**. CISA ordered Federal Civilian Executive Branch agencies to remediate the issue within days under **BOD 26-04**, while internet scanning data cited by Shadowserver shows more than **10,000** SharePoint servers remain exposed online. Separately, Microsoft disclosed a ransomware investigation involving **Storm-2603** and another threat actor operating in the same compromised environment, where the attackers used persistence, remote access tools, privilege escalation, and defense evasion after initial access was likely obtained through **`CVE-2025-11371`** in Gladinet Triofox.
Jul 12, 2026