CISA Adds Actively Exploited Microsoft SharePoint RCE to KEV Catalog

CISA added CVE-2026-20963, a Microsoft SharePoint deserialization flaw, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The vulnerability allows an unauthorized remote attacker to execute arbitrary code over the network by sending crafted serialized data that SharePoint improperly deserializes, creating a pre-authentication remote code execution path. Reporting indicates the specific threat actors behind the attacks have not been publicly identified, but the flaw affects a widely deployed enterprise collaboration platform that often stores sensitive internal documents and communications.

The KEV entry triggered urgent remediation requirements, including a March 21, 2026 deadline for FCEB agencies under Binding Operational Directive 22-01. Additional reporting notes that the same KEV update also included vulnerabilities in Wing FTP Server and Synacor Zimbra Collaboration Suite, but the SharePoint issue stands out because of its likely value for initial access brokers and ransomware affiliates seeking enterprise footholds. Organizations using SharePoint should treat internet-exposed systems as high priority for patching and review for signs of compromise given confirmed in-the-wild exploitation.