Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2026-20963)

What is affected, what to do

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5535.1001, Microsoft SharePoint Server 2019 to version 16.0.10417.20083, Microsoft SharePoint Server Subscription Edition to version 16.0.19127.20442. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft SharePoint Enterprise Server 2016 lt 16.0.0..16.0.5535.1001
• Microsoft SharePoint Server 2019 lt 16.0.0..16.0.10417.20083
• Microsoft SharePoint Server Subscription Edition lt 16.0.0..16.0.19127.20442

Fixed in

• Microsoft SharePoint Enterprise Server 2016 16.0.5535.1001
• Microsoft SharePoint Server 2019 16.0.10417.20083
• Microsoft SharePoint Server Subscription Edition 16.0.19127.20442

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Find exposed farms first: Inventory every SharePoint server reachable from the internet (TCP 80/443, including publication via a reverse proxy or ADC). Check the build with (Get-SPFarm).BuildVersion. Builds below 16.0.5535.1001 (Enterprise Server 2016), 16.0.10417.20083 (Server 2019) and 16.0.19127.20442 (Subscription Edition) are vulnerable.
   • Apply the security update: Install the update that delivers those builds. Look up the KB number in the Microsoft Security Update Guide entry for CVE-2026-20963. Then run PSConfig.exe -cmd upgrade -inplace b2b -wait or the Products Configuration Wizard on every server. The fix is incomplete without this step.
   • If you cannot patch now: Block external access to the web applications at the firewall or reverse proxy, or restrict it to VPN or zero-trust access, until the patch is in place.
   • Hunt before reconnecting: Review IIS logs and EDR telemetry back to at least the KEV addition date (see Detection rules). Check the LAYOUTS directories (...\Web Server Extensions\16\TEMPLATE\LAYOUTS\) for newly created .aspx files.
   • Rotate key material: If compromise is suspected, and as a precaution after patching, rotate the ASP.NET machine keys. Use Set-SPMachineKey/Update-SPMachineKey or the "Machine Key Rotation" timer job, then run iisreset on all servers. A stolen ValidationKey otherwise keeps signed payloads working after the patch.
   • Secure service accounts: On confirmed code execution, reset the passwords of the farm, app-pool and search service accounts. Review AD logons by these accounts for lateral movement.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Publish SharePoint only behind a pre-authenticating reverse proxy (e.g. Entra Application Proxy, ADFS WAP, F5 APM). Apply egress filtering so servers can reach only update and Microsoft 365 endpoints, which stops payload staging and C2.
   • AMSI integration: Enable SharePoint AMSI integration per web application, using Full Mode on Subscription Edition and 2019. Run Defender AV or another AMSI-capable product on every farm server.
   • WAF/IPS: Block or alert on unauthenticated POSTs to /_layouts/15/*.aspx and /_vti_bin/* that carry oversized or Base64-heavy bodies or ViewState parameters. Give spoofed-Referer requests involving /_layouts/SignOut.aspx dedicated handling. Enable vendor signatures for CVE-2026-20963 once they are released.
   • Endpoint hardening: Use an ASR rule or EDR policy to stop w3wp.exe from spawning cmd.exe, powershell.exe, csc.exe or certutil.exe. Test the rule in audit mode first.
   • Least privilege: Run app-pool identities without local admin rights and keep them separate from the farm account. Restrict their SQL permissions.
3. 03

   Runbook step 3

   Detection rules

   • EDR/Sysmon process ancestry (EID 1, Security 4688): w3wp.exe spawns a shell or compiler. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","csc.exe","rundll32.exe")
   • Webshell drop (Sysmon EID 11): A new .aspx or .ashx under the LAYOUTS path, written by w3wp.exe or one of its children. Sigma shape: TargetFilename|contains: '\TEMPLATE\LAYOUTS\' AND TargetFilename|endswith: '.aspx'.
   • IIS access logs: Unauthenticated POSTs (cs-username = -) to /_layouts/15/ returning 200, followed by GETs to previously unseen .aspx files. SPL: index=iis cs_method=POST cs_uri_stem="/_layouts/15/*" cs_username="-" | stats count by c_ip, cs_uri_stem
   • Key theft: PowerShell script-block logs (EID 4104) or AMSI events referencing MachineKeySection, ValidationKey or System.Web.Configuration. Triage any Defender alerts for SharePoint exploit or webshell signatures.
   • Network (Zeek/Suricata): Outbound connections from SharePoint servers to unfamiliar destinations, or unusual DNS lookups, shortly after bursts of inbound POSTs.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Source: NCSC NZ (CC BY 4.0), pwn.watch, NVD (NIST), Microsoft Security Update Guide, cvelistv5, CISA KEV Catalog, CVE.org (MITRE), certeu_advisory

Vendors and products

• Microsoft Microsoft Sharepoint Enterprise Server 2016
• Microsoft Microsoft Sharepoint Server 2019
• Microsoft Microsoft Sharepoint Server Subscription Edition
• Microsoft Microsoft SharePoint Server Subscription Edition

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• Microsoft Security Update GuideMicrosoft SharePoint Remote Code Execution VulnerabilityVendor advisory, Patch, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963government-resource, US government resource
• pwn.watchpwn.watch: Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-20963pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch