The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical Microsoft SharePoint vulnerability that is now being actively exploited in the wild. This flaw affects on‑premises SharePoint servers and allows attackers to execute malicious code remotely with no authentication required. For organizations that still rely on SharePoint Server, this represents a serious and immediate risk.
What Is the Vulnerability?
The vulnerability is tracked as CVE‑2026‑20963 and was originally patched by Microsoft during the January 2026 Patch Tuesday release. It impacts the following versions of SharePoint Server:
- SharePoint Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
The flaw is caused by improper handling of deserialization of untrusted data. In simple terms, SharePoint does not properly validate certain incoming data, which allows a remote attacker to inject and execute arbitrary code on the server. Because the attack does not require authentication and is considered low complexity, it is especially dangerous for internet‑facing SharePoint environments.
Microsoft initially rated the vulnerability as critical with a CVSS score as high as 9.8, but at the time believed exploitation was less likely. That assessment has now changed.
Why Is This a Big Deal Now?
In March 2026, CISA added CVE‑2026‑20963 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that the flaw is being abused in real‑world attacks. Federal civilian agencies were given a very short remediation window, underscoring the seriousness of the threat.
While specific attack details have not been publicly released, CISA emphasized that vulnerabilities like this are frequently used by threat actors as initial access points. Once attackers gain remote code execution on a SharePoint server, they can deploy malware, establish persistence, steal data, or pivot deeper into the network.
How SharePoint Is Commonly Exploited
SharePoint is a high‑value target because it often contains sensitive business documents and integrates tightly with Active Directory and other core systems. Successful exploitation of SharePoint vulnerabilities can lead to:
- Full server compromise
- Data exfiltration of internal documents
- Deployment of web shells or backdoors
- Lateral movement to domain controllers and file servers
Although there is currently no confirmed link between this vulnerability and ransomware campaigns, remote code execution flaws are commonly leveraged by ransomware operators once exploitation becomes widespread.
Who Is Most at Risk?
Organizations most at risk include:
- Businesses running on‑premises SharePoint servers
- Environments where SharePoint is exposed to the internet
- Companies running end‑of‑support SharePoint versions such as 2007, 2010, or 2013
Older, unsupported versions are especially dangerous because they no longer receive security updates, leaving organizations permanently exposed unless they upgrade or decommission the server.
What Microsoft and CISA Recommend
Microsoft has confirmed that customers who installed the January 2026 security updates are already protected. CISA strongly urges all organizations, not just federal agencies, to take immediate action.
Recommended steps include:
- Apply all January 2026 SharePoint security updates
- Confirm patch installation across all SharePoint servers
- Remove or restrict internet access to SharePoint where possible
- Upgrade unsupported SharePoint versions immediately
- Monitor for unusual activity or indicators of compromise
If mitigations are not available, organizations are advised to discontinue use of affected systems until they can be properly secured.
What This Means for Your Business
Even if SharePoint is no longer heavily used, an unpatched on‑premises server can act as a hidden entry point for attackers. Many environments continue to operate legacy SharePoint instances that were deployed years ago and have not been closely maintained.
Incidents like this highlight the importance of regular patching, accurate asset inventories, and visibility into older systems that may still be running quietly in the background.
