Microsoft SharePoint Server Deserialization RCE (CVE-2026-20963) — CISA KEV Active Exploitation

Key facts for SharePoint ViewState deserialization

Detection coverage for SharePoint ViewState deserialization

As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0261 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SharePoint w3wp.exe Spawning Command Interpreters — Post-Exploitation Activity

Detects the SharePoint IIS worker process (w3wp.exe) spawning command interpreters such as cmd.exe, powershell.exe, pwsh.exe, or rundll32.exe. This behavior is a strong indicator of post-exploitation command execution following successful CVE-2026-20963 deserialization RCE, where the attacker's gadget chain triggers arbitrary process creation under the SharePoint application pool context.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.001, T1059.003
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\rundll32.exe") | eval risk_score=case(match(Image, "(?i)powershell"), 90, match(Image, "(?i)rundll32"), 85, match(Image, "(?i)cmd\.exe"), 75, 1=1, 50) | stats count values(Image) as child_processes values(CommandLine) as commands values(User) as users by ParentImage, Computer | table _time, Computer, ParentImage, child_processes, commands, users, risk_score, count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe")
| extend RiskScore = case(FileName =~ "powershell.exe", 90, FileName =~ "rundll32.exe", 85, FileName =~ "cmd.exe", 75, 50)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, RiskScore

Sigma

title: SharePoint w3wp.exe Spawning Command Interpreter — CVE-2026-20963 Post-Exploitation
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SharePoint IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, pwsh.exe, or rundll32.exe indicating post-exploitation command execution following CVE-2026-20963 deserialization RCE
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/21
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.20963
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate SharePoint health monitoring scripts
    - SharePoint Timer Service operations invoking command interpreters
    - Authorized SharePoint administration via PowerShell remoting
level: high

Known false positives:

• Legitimate SharePoint health monitoring scripts
• SharePoint Timer Service operations that invoke command interpreters
• Authorized SharePoint administration via PowerShell remoting

Tuning notes: Whitelist known SharePoint maintenance scripts and scheduled tasks by CommandLine pattern. Add exclusions for authorized SharePoint admin accounts. Consider adding ParentCommandLine filter for specific SharePoint app pool identities.

• 🔒 SharePoint Anomalous POST Requests to _layouts/ Endpoints — Exploitation Indicator · unlock with TL Creds
• 🔒 ASPX Web Shell Deployment in SharePoint LAYOUTS Directory — Post-Exploitation · unlock with TL Creds
• 🔒 SharePoint Configuration File Access by Suspicious Process — Credential Harvesting · unlock with TL Creds
• 🔒 SharePoint ViewState Deserialization Exploit Request Pattern — IIS Log Detection · unlock with TL Creds
• 🔒 ASPX Web Shell Deployment in SharePoint Content Directories — Persistence · unlock with TL Creds
• 🔒 SharePoint Server w3wp.exe Outbound C2 Beaconing — Network Connection · unlock with TL Creds
• 🔒 SharePoint ViewState Deserialization Exploit — Oversized POST to /_layouts/ Endpoints · unlock with TL Creds
• 🔒 SharePoint w3wp.exe Outbound Network Connections to External Hosts — C2 Activity · unlock with TL Creds

Indicators of compromise for SharePoint ViewState deserialization

As of 2026-03-21, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0261.

How SharePoint ViewState deserialization works

CVE-2026-20963 is a remote code execution vulnerability in Microsoft SharePoint Server caused by the unsafe deserialization of untrusted data (CWE-502). The flaw resides in the handling of serialized objects within ASP.NET ViewState and related serialized data streams processed by SharePoint application pages under the /_layouts/ directory.

The root cause is the absence of adequate type validation during deserialization of user-supplied data. Formatters such as BinaryFormatter and ObjectStateFormatter are used without stringent type-filtering surrogates, allowing an attacker to instantiate arbitrary classes available in the application domain through the serialized stream. An attacker with low-level authentication can craft a malicious serialized payload using tools like Ysoserial.net to generate .NET gadget chains, base64-encode the payload, and embed it in the __VIEWSTATE parameter of a POST request to a vulnerable /_layouts/ endpoint.

When the SharePoint server processes the request, it deserializes the payload and triggers the gadget chain, executing arbitrary code in the context of the SharePoint application pool process (w3wp.exe), which typically runs as the SharePoint service account. This grants the attacker the ability to deploy web shells (commonly ASPX variants such as spinstall0.aspx dropped in the TEMPLATE\LAYOUTS directory), access or exfiltrate sensitive data, manipulate SharePoint content, steal machineKey material for persistent access, and move laterally within the enterprise environment.

Microsoft disclosed the vulnerability and released security patches as part of the January 2026 Patch Tuesday on January 13, 2026, initially rating exploitation as "less likely." However, active exploitation was confirmed by March 2026, leading CISA to add CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on March 18, 2026, with a federal agency remediation deadline of March 21, 2026.

The patched implementation introduces cryptographic integrity checks and strict type bounding to verify the origin and composition of serialized data before deserialization occurs. SharePoint Server 2007, 2010, and 2013 are also vulnerable but are end-of-support and no longer receive security updates.

No specific threat actor attribution has been publicly disclosed, though ongoing exploitation has been observed across operational environments. The combination of SharePoint's ubiquity in enterprise environments, low attack complexity, and the availability of tooling for gadget chain generation makes this vulnerability a high-priority target for both opportunistic attackers and advanced persistent threat groups.

MITRE ATT&CK techniques by tactic:

credential-access

T1003 OS Credential Dumping; T1552 Unsecured Credentials

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1550 Use Alternate Authentication Material

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol

persistence

T1133 External Remote Services; T1505 Server Software Component

initial-access

T1190 Exploit Public-Facing Application

collection

T1213 Data from Information Repositories

discovery

T1518 Software Discovery

impact

T1565 Data Manipulation

exfiltration

T1567 Exfiltration Over Web Service

Remediation for SharePoint ViewState deserialization

Patches

• KB5002828 — SharePoint Enterprise Server 2016 (updates to 16.0.5535.1001)
• KB5002825 — SharePoint Server 2019 (updates to 16.0.10417.20083)
• SharePoint Server Subscription Edition update to 16.0.19127.20442 or later

Immediate actions

• Apply Microsoft security patches KB5002828 (SharePoint 2016) and KB5002825 (SharePoint 2019) immediately
• Patch SharePoint Server Subscription Edition to version 16.0.19127.20442 or later
• Restrict network access to SharePoint /_layouts/ endpoints from untrusted sources
• Monitor IIS logs for anomalous POST requests to /_layouts/ endpoints with large or encoded __VIEWSTATE parameters
• Scan SharePoint TEMPLATE\LAYOUTS directory for unauthorized .aspx files (webshells)
• Hunt for w3wp.exe spawning cmd.exe, powershell.exe, or rundll32.exe in EDR telemetry

Workarounds

• If patching is not immediately possible, restrict access to SharePoint /_layouts/ endpoints via network ACLs or reverse proxy rules
• Disable or restrict access to internet-facing SharePoint farms until patches are applied
• Implement strict ViewState MAC validation enforcement
• Block known Ysoserial.net gadget chain patterns at the WAF layer

Longer-term hardening

• Implement network segmentation to isolate SharePoint servers from general user networks
• Deploy Web Application Firewall (WAF) rules to block .NET deserialization patterns in POST requests
• Enable file integrity monitoring (FIM) on SharePoint content directories
• Enforce least privilege for SharePoint service accounts
• Deploy EDR with behavioral detection for deserialization exploitation patterns
• Migrate off end-of-support SharePoint versions (2007, 2010, 2013) that will not receive patches
• Review and restrict SharePoint permissions to enforce least privilege access

Affected and fixed versions

• Microsoft — SharePoint Enterprise Server 2016
  Vulnerable versions: 16.0.0 to 16.0.5535.1000
  Fixed in: 16.0.5535.1001 (KB5002828)
• Microsoft — SharePoint Server 2019
  Vulnerable versions: 16.0.0 to 16.0.10417.20082
  Fixed in: 16.0.10417.20083 (KB5002825)
• Microsoft — SharePoint Server Subscription Edition
  Vulnerable versions: 16.0.0 to 16.0.19127.20441
  Fixed in: 16.0.19127.20442
• Microsoft — SharePoint Server 2013 (End of Support)
  Vulnerable versions: All versions
  Fixed in: No patch available — end of support
• Microsoft — SharePoint Server 2010 (End of Support)
  Vulnerable versions: All versions
  Fixed in: No patch available — end of support

Timeline of SharePoint ViewState deserialization

• 2026-01-13 Security updates KB5002828 (SharePoint 2016), KB5002825 (SharePoint 2019), and Subscription Edition update released to address deserialization vulnerability.
• 2026-01-13 Microsoft discloses CVE-2026-20963 and releases security patches as part of January 2026 Patch Tuesday. Initially rated as less likely to be exploited.
• 2026-03-18 Active exploitation of CVE-2026-20963 confirmed in the wild. Attacks leverage ViewState deserialization via /_layouts/ endpoints to achieve remote code execution on unpatched SharePoint servers.
• 2026-03-18 CISA adds CVE-2026-20963 to Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation observed across operational environments.
• 2026-03-19 Multiple security vendors and media outlets publish advisories and analysis, including BleepingComputer, Help Net Security, SecurityWeek, and Truesec.
• 2026-03-21 CISA-mandated remediation deadline for US federal civilian agencies under BOD 22-01. All affected agencies must have patches applied or mitigations in place.
• 2026-05-29 As of 2026-05-29, CVE-2026-20963 (SharePoint deserialization RCE) remains actively exploited and listed in CISA KEV, with ongoing locked-ioc-12 web-shell deployment, machineKey theft, and IIS-module persistence against unpatched servers despite Microsoft's January 2026 fix. No successor supersedes it; the May 2026 SharePoint CVE-2026-45659 is a separate, distinct flaw.

Sources cited for SharePoint ViewState deserialization

• CISA Adds One Known Exploited Vulnerability to Catalog (March 18, 2026) CISA · Government advisory · 2026-03-18
• NVD — CVE-2026-20963 NVD (NIST) · Advisory · 2026-01-13
• CISA KEV Catalog Entry CISA · Government advisory · 2026-03-18
• Microsoft Security Update Guide — CVE-2026-20963 Microsoft Security Response Center · Vendor report · 2026-01-13
• CVEReports — CVE-2026-20963 Remote Code Execution via Insecure Deserialization cvereports.com · Research · 2026-03-18
• SentinelOne Vulnerability Database — CVE-2026-20963 SentinelOne · Research · 2026-03-18
• CIRCL Vulnerability Lookup — CVE-2026-20963 vulnerability.circl.lu · Research · 2026-03-18
• Truesec — CVE-2026-20963 Actively Exploited SharePoint Deserialization Vulnerability truesec.com · Blog · 2026-03-19
• Windows Forum — CVE-2026-20963 Urgent SharePoint RCE Patch and Hunt Guide windowsforum.com · Blog · 2026-03-19
• RedLegg Security Bulletin — RCE Vulnerability in Microsoft Office SharePoint redlegg.com · Blog · 2026-03-19
• Help Net Security — CISA warns of active exploitation of SharePoint vulnerability Help Net Security · News · 2026-03-19
• BleepingComputer — Critical Microsoft SharePoint flaw now exploited in attacks BleepingComputer · News · 2026-03-19
• SecurityWeek — CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability SecurityWeek · News · 2026-03-19
• The Hacker News — CISA Warns of Zimbra, SharePoint Flaw Exploits The Hacker News · News · 2026-03-19

Threats related to SharePoint ViewState deserialization

• CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation
• Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)
• Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
• Microsoft SharePoint Authenticated RCE via Deserialization of Untrusted Data (CVE-2026-45659)
• Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054)

Related coverage of this activity

• SharePoint JWT forgery Pwn2Own Berlin
• Bing Images SVG command injection