PT-2026-2760 · Microsoft · Sharepoint Server

Published 2026-01-13 · Updated 2026-05-18 · CVE-2026-20963

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SharePoint Enterprise Server 2016 SharePoint Server 2019 SharePoint Server Subscription Edition

Description Microsoft Office SharePoint contains a flaw involving the deserialization of untrusted data. Deserialization is the process of converting data from a format like XML or JSON back into an object that a program can use. This issue allows an unauthenticated remote attacker to execute arbitrary code over a network without requiring user interaction by sending a crafted request to the server. Real-world exploitation of this flaw has been confirmed.

Recommendations Apply the security updates released in January for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Fix

DoS

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-00638

CVE-2026-20963

Affected Products

Sharepoint Server

References · 90

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20963 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20963 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20963 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00638 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963 · Vendor Advisory
• https://reddit.com/r/blueteamsec/comments/1ry5vfv/cve202620963_sharepoint_deserialization · Reddit Post
• https://twitter.com/the_yellow_fall/status/2034464189914247537 · Twitter Post
• https://twitter.com/CisoRaging77913/status/2043918555448500286 · Twitter Post
• https://twitter.com/NSIguy/status/2035083958874996894 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/2034611677040353465 · Twitter Post
• https://twitter.com/ZyberWallS/status/2034900330815926332 · Twitter Post
• https://twitter.com/ninp0/status/2034688945242652989 · Twitter Post
• https://twitter.com/DefusedCyber/status/2034561341814378935 · Twitter Post
• https://twitter.com/secharvesterx/status/2034600959746211898 · Twitter Post
• https://twitter.com/RedLegg/status/2034748123889672326 · Twitter Post