PT-2026-2760 · Microsoft · Sharepoint Server

Published 2026-01-13 · Updated 2026-05-08 · CVE-2026-20963

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SharePoint Enterprise Server 2016 SharePoint Server 2019 SharePoint Server Subscription Edition

Description Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthenticated remote attacker to execute arbitrary code over a network. This issue does not require user interaction or credentials. Real-world exploitation of this flaw has been confirmed, and it has been added to the Known Exploited Vulnerabilities catalog.

Recommendations Apply the security updates released in January for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-00638

CVE-2026-20963

Affected Products

Sharepoint Server

References · 88

• https://osv.dev/vulnerability/CVE-2026-20963 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20963 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20963 · Security Note
• https://twitter.com/ZyberWallS/status/2034855304027152467 · Twitter Post
• https://twitter.com/Matrium_Tech/status/2036596416852963785 · Twitter Post
• https://twitter.com/twelvesec/status/2035929282216620535 · Twitter Post
• https://reddit.com/r/blueteamsec/comments/1ry5vfv/cve202620963_sharepoint_deserialization · Reddit Post
• https://twitter.com/TheHackerWire/status/2011146168294916254 · Twitter Post
• https://t.me/avleonovcom/1645 · Telegram Post
• https://twitter.com/theluemmel/status/2036829953187008828 · Twitter Post
• https://twitter.com/ZyberWallS/status/2035279243089944999 · Twitter Post
• https://twitter.com/404LABSx/status/2034935043919950087 · Twitter Post
• https://twitter.com/DefusedCyber/status/2034561341814378935 · Twitter Post