Microsoft SharePoint Server Deserialization RCE (CVE-2026-20963) — CISA KEV Active Exploitation
Microsoft SharePoint Server Deserialization RCE (TL-2026-0261) is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-03-21. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 1 CVE (CVE-2026-20963), maps to 15 MITRE ATT&CK techniques (T1003, T1027, T1036), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0261
- Threat ID
- TL-2026-0261
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-03-21
- Last reviewed
- 2026-03-21
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, education, technology, defense, critical-infrastructure, legal, energy, manufacturing
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Microsoft SharePoint Server Deserialization RCE
Malware and tooling: Ysoserial.net
CVE-2026-20963 is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server enabling remote code execution. Added to CISA KEV on March 18, 2026 with confirmed active exploitation in the wild. Attackers exploit unsafe ViewState deserialization via /_layouts/ endpoints to achieve arbitrary code execution, deploy web shells, and move laterally within enterprise networks.
How Microsoft SharePoint Server Deserialization RCE works
CVE-2026-20963 is a remote code execution vulnerability in Microsoft SharePoint Server caused by the unsafe deserialization of untrusted data (CWE-502). The flaw resides in the handling of serialized objects within ASP.NET ViewState and related serialized data streams processed by SharePoint application pages under the /_layouts/ directory.
The root cause is the absence of adequate type validation during deserialization of user-supplied data. Formatters such as BinaryFormatter and ObjectStateFormatter are used without stringent type-filtering surrogates, allowing an attacker to instantiate arbitrary classes available in the application domain through the serialized stream. An attacker with low-level authentication can craft a malicious serialized payload using tools like Ysoserial.net to generate .NET gadget chains, base64-encode the payload, and embed it in the __VIEWSTATE parameter of a POST request to a vulnerable /_layouts/ endpoint.
When the SharePoint server processes the request, it deserializes the payload and triggers the gadget chain, executing arbitrary code in the context of the SharePoint application pool process (w3wp.exe), which typically runs as the SharePoint service account. This grants the attacker the ability to deploy web shells (commonly ASPX variants such as spinstall0.aspx dropped in the TEMPLATE\LAYOUTS directory), access or exfiltrate sensitive data, manipulate SharePoint content, steal machineKey material for persistent access, and move laterally within the enterprise environment.
Microsoft disclosed the vulnerability and released security patches as part of the January 2026 Patch Tuesday on January 13, 2026, initially rating exploitation as "less likely." However, active exploitation was confirmed by March 2026, leading CISA to add CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on March 18, 2026, with a federal agency remediation deadline of March 21, 2026.
The patched implementation introduces cryptographic integrity checks and strict type bounding to verify the origin and composition of serialized data before deserialization occurs. SharePoint Server 2007, 2010, and 2013 are also vulnerable but are end-of-support and no longer receive security updates.
No specific threat actor attribution has been publicly disclosed, though ongoing exploitation has been observed across operational environments. The combination of SharePoint's ubiquity in enterprise environments, low attack complexity, and the availability of tooling for gadget chain generation makes this vulnerability a high-priority target for both opportunistic attackers and advanced persistent threat groups.
MITRE ATT&CK techniques used in TL-2026-0261
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1550 Use Alternate Authentication Material
execution
T1059 Command and Scripting Interpreter
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol
persistence
T1133 External Remote Services; T1505 Server Software Component
initial-access
T1190 Exploit Public-Facing Application
collection
T1213 Data from Information Repositories
discovery
impact
exfiltration
Affected products and versions in Microsoft SharePoint Server Deserialization RCE
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: 16.0.0 to 16.0.5535.1000
Fixed in: 16.0.5535.1001 (KB5002828) - Microsoft — SharePoint Server 2019
Vulnerable versions: 16.0.0 to 16.0.10417.20082
Fixed in: 16.0.10417.20083 (KB5002825) - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: 16.0.0 to 16.0.19127.20441
Fixed in: 16.0.19127.20442 - Microsoft — SharePoint Server 2013 (End of Support)
Vulnerable versions: All versions
Fixed in: No patch available — end of support - Microsoft — SharePoint Server 2010 (End of Support)
Vulnerable versions: All versions
Fixed in: No patch available — end of support
Remediation for Microsoft SharePoint Server Deserialization RCE
Patches
- KB5002828 — SharePoint Enterprise Server 2016 (updates to 16.0.5535.1001)
- KB5002825 — SharePoint Server 2019 (updates to 16.0.10417.20083)
- SharePoint Server Subscription Edition update to 16.0.19127.20442 or later
Immediate actions
- Apply Microsoft security patches KB5002828 (SharePoint 2016) and KB5002825 (SharePoint 2019) immediately
- Patch SharePoint Server Subscription Edition to version 16.0.19127.20442 or later
- Restrict network access to SharePoint /_layouts/ endpoints from untrusted sources
- Monitor IIS logs for anomalous POST requests to /_layouts/ endpoints with large or encoded __VIEWSTATE parameters
- Scan SharePoint TEMPLATE\LAYOUTS directory for unauthorized .aspx files (webshells)
- Hunt for w3wp.exe spawning cmd.exe, powershell.exe, or rundll32.exe in EDR telemetry
Workarounds
- If patching is not immediately possible, restrict access to SharePoint /_layouts/ endpoints via network ACLs or reverse proxy rules
- Disable or restrict access to internet-facing SharePoint farms until patches are applied
- Implement strict ViewState MAC validation enforcement
- Block known Ysoserial.net gadget chain patterns at the WAF layer
Longer-term hardening
- Implement network segmentation to isolate SharePoint servers from general user networks
- Deploy Web Application Firewall (WAF) rules to block .NET deserialization patterns in POST requests
- Enable file integrity monitoring (FIM) on SharePoint content directories
- Enforce least privilege for SharePoint service accounts
- Deploy EDR with behavioral detection for deserialization exploitation patterns
- Migrate off end-of-support SharePoint versions (2007, 2010, 2013) that will not receive patches
- Review and restrict SharePoint permissions to enforce least privilege access
CVEs associated with Microsoft SharePoint Server Deserialization RCE
Weaknesses (CWE) in Microsoft SharePoint Server Deserialization RCE
CWE-502
Timeline of Microsoft SharePoint Server Deserialization RCE
- Security updates KB5002828 (SharePoint 2016), KB5002825 (SharePoint 2019), and Subscription Edition update released to address deserialization vulnerability.
- Microsoft discloses CVE-2026-20963 and releases security patches as part of January 2026 Patch Tuesday. Initially rated as less likely to be exploited.
- Active exploitation of CVE-2026-20963 confirmed in the wild. Attacks leverage ViewState deserialization via /_layouts/ endpoints to achieve remote code execution on unpatched SharePoint servers.
- CISA adds CVE-2026-20963 to Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation observed across operational environments.
- Multiple security vendors and media outlets publish advisories and analysis, including BleepingComputer, Help Net Security, SecurityWeek, and Truesec.
- CISA-mandated remediation deadline for US federal civilian agencies under BOD 22-01. All affected agencies must have patches applied or mitigations in place.
- As of 2026-05-29, CVE-2026-20963 (SharePoint deserialization RCE) remains actively exploited and listed in CISA KEV, with ongoing spinstall0.aspx web-shell deployment, machineKey theft, and IIS-module persistence against unpatched servers despite Microsoft's January 2026 fix. No successor supersedes it; the May 2026 SharePoint CVE-2026-45659 is a separate, distinct flaw.
Sources cited for Microsoft SharePoint Server Deserialization RCE
- CISA Adds One Known Exploited Vulnerability to Catalog (March 18, 2026)
- Microsoft Security Update Guide — CVE-2026-20963
- NVD — CVE-2026-20963
- CISA KEV Catalog Entry
- Help Net Security — CISA warns of active exploitation of SharePoint vulnerability
- BleepingComputer — Critical Microsoft SharePoint flaw now exploited in attacks
- Truesec — CVE-2026-20963 Actively Exploited SharePoint Deserialization Vulnerability
- CVEReports — CVE-2026-20963 Remote Code Execution via Insecure Deserialization
- SecurityWeek — CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability
- Windows Forum — CVE-2026-20963 Urgent SharePoint RCE Patch and Hunt Guide
- SentinelOne Vulnerability Database — CVE-2026-20963
- RedLegg Security Bulletin — RCE Vulnerability in Microsoft Office SharePoint
- CIRCL Vulnerability Lookup — CVE-2026-20963
- The Hacker News — CISA Warns of Zimbra, SharePoint Flaw Exploits
Threats related to Microsoft SharePoint Server Deserialization RCE
- CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation
- Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)
- Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
- Microsoft SharePoint Authenticated RCE via Deserialization of Untrusted Data (CVE-2026-45659)
- Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054)
- CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Unpatched Chain Component, PoC Public)
Detection coverage for TL-2026-0261
As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0261 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.