cve 2026 20963

CVE-2026-20963 is a Microsoft SharePoint Server remote code execution vulnerability caused by deserialization of untrusted data. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog in March 2026 after evidence of active exploitation. The vulnerability affects on-premises SharePoint deployments and can enable code execution, privilege escalation, or post-compromise footholds. Microsoft's advisory provides limited technical details but signals operational urgency through vendor confidence metrics. Defenders are advised to prioritize patching via security updates and conduct aggressive threat hunting for indicators of compromise in SharePoint environments. The tag covers discussions on the vulnerability's impact, CISA KEV inclusion, and remediation strategies for enterprise SharePoint estates.