# Microsoft SharePoint Server Deserialization RCE (CVE-2026-20963) — CISA KEV Active Exploitation

> CVE-2026-20963 is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server enabling remote code execution. Added to CISA KEV on March 18, 2026 with confirmed active exploitation in the wild. Attackers exploit unsafe ViewState deserialization via /_layouts/ endpoints to achieve arbitrary code execution, deploy web shells, and move laterally within enterprise networks.

- **Published:** 2026-03-21T12:00:00Z
- **Last reviewed:** 2026-03-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0261
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sharepoint-viewstate-deserialization-tl-2026-0261.webp?v=b424a5fe (Threadlinqs threat intel: CVE-2026-20963 Microsoft SharePoint RCE: Detection & IOCs (TL-2026-0261) — Critical severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0261
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-20963

## Description

CVE-2026-20963 is a remote code execution vulnerability in Microsoft SharePoint Server caused by the unsafe deserialization of untrusted data (CWE-502). The flaw resides in the handling of serialized objects within ASP.NET ViewState and related serialized data streams processed by SharePoint application pages under the /_layouts/ directory.

The root cause is the absence of adequate type validation during deserialization of user-supplied data. Formatters such as BinaryFormatter and ObjectStateFormatter are used without stringent type-filtering surrogates, allowing an attacker to instantiate arbitrary classes available in the application domain through the serialized stream. An attacker with low-level authentication can craft a malicious serialized payload using tools like Ysoserial.net to generate .NET gadget chains, base64-encode the payload, and embed it in the __VIEWSTATE parameter of a POST request to a vulnerable /_layouts/ endpoint.

When the SharePoint server processes the request, it deserializes the payload and triggers the gadget chain, executing arbitrary code in the context of the SharePoint application pool process (w3wp.exe), which typically runs as the SharePoint service account. This grants the attacker the ability to deploy web shells (commonly ASPX variants such as spinstall0.aspx dropped in the TEMPLATE\LAYOUTS directory), access or exfiltrate sensitive data, manipulate SharePoint content, steal machineKey material for persistent access, and move laterally within the enterprise environment.

Microsoft disclosed the vulnerability and released security patches as part of the January 2026 Patch Tuesday on January 13, 2026, initially rating exploitation as "less likely." However, active exploitation was confirmed by March 2026, leading CISA to add CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on March 18, 2026, with a federal agency remediation deadline of March 21, 2026.

The patched implementation introduces cryptographic integrity checks and strict type bounding to verify the origin and composition of serialized data before deserialization occurs. SharePoint Server 2007, 2010, and 2013 are also vulnerable but are end-of-support and no longer receive security updates.

No specific threat actor attribution has been publicly disclosed, though ongoing exploitation has been observed across operational environments. The combination of SharePoint's ubiquity in enterprise environments, low attack complexity, and the availability of tooling for gadget chain generation makes this vulnerability a high-priority target for both opportunistic attackers and advanced persistent threat groups.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1518 Software Discovery
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SharePoint w3wp.exe Spawning Command Interpreters — Post-Exploitation Activity** (`TL-2026-0261-SPL-002`)

Detects the SharePoint IIS worker process (w3wp.exe) spawning command interpreters such as cmd.exe, powershell.exe, pwsh.exe, or rundll32.exe. This behavior is a strong indicator of post-exploitation command execution following successful CVE-2026-20963 deserialization RCE, where the attacker's gadget chain triggers arbitrary process creation under the SharePoint application pool context.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1059.003
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\rundll32.exe") | eval risk_score=case(match(Image, "(?i)powershell"), 90, match(Image, "(?i)rundll32"), 85, match(Image, "(?i)cmd\.exe"), 75, 1=1, 50) | stats count values(Image) as child_processes values(CommandLine) as commands values(User) as users by ParentImage, Computer | table _time, Computer, ParentImage, child_processes, commands, users, risk_score, count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe")
| extend RiskScore = case(FileName =~ "powershell.exe", 90, FileName =~ "rundll32.exe", 85, FileName =~ "cmd.exe", 75, 50)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, RiskScore
```

### Sigma

```yaml
title: SharePoint w3wp.exe Spawning Command Interpreter — CVE-2026-20963 Post-Exploitation
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SharePoint IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, pwsh.exe, or rundll32.exe indicating post-exploitation command execution following CVE-2026-20963 deserialization RCE
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/21
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.20963
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate SharePoint health monitoring scripts
    - SharePoint Timer Service operations invoking command interpreters
    - Authorized SharePoint administration via PowerShell remoting
level: high
```

**Known false positives:**

- Legitimate SharePoint health monitoring scripts
- SharePoint Timer Service operations that invoke command interpreters
- Authorized SharePoint administration via PowerShell remoting

**Tuning notes:** Whitelist known SharePoint maintenance scripts and scheduled tasks by CommandLine pattern. Add exclusions for authorized SharePoint admin accounts. Consider adding ParentCommandLine filter for specific SharePoint app pool identities.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SharePoint Anomalous POST Requests to _layouts/ Endpoints — Exploitation Indicator (locked: unlock with TL Creds)
- ASPX Web Shell Deployment in SharePoint LAYOUTS Directory — Post-Exploitation (locked: unlock with TL Creds)
- SharePoint Configuration File Access by Suspicious Process — Credential Harvesting (locked: unlock with TL Creds)
- SharePoint ViewState Deserialization Exploit Request Pattern — IIS Log Detection (locked: unlock with TL Creds)
- ASPX Web Shell Deployment in SharePoint Content Directories — Persistence (locked: unlock with TL Creds)
- SharePoint Server w3wp.exe Outbound C2 Beaconing — Network Connection (locked: unlock with TL Creds)
- SharePoint ViewState Deserialization Exploit — Oversized POST to /_layouts/ Endpoints (locked: unlock with TL Creds)
- SharePoint w3wp.exe Outbound Network Connections to External Hosts — C2 Activity (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog (March 18, 2026)](https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog-0)
- [Microsoft Security Update Guide — CVE-2026-20963](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963)
- [NVD — CVE-2026-20963](https://nvd.nist.gov/vuln/detail/CVE-2026-20963)
- [CISA KEV Catalog Entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963)
- [Help Net Security — CISA warns of active exploitation of SharePoint vulnerability](https://www.helpnetsecurity.com/2026/03/19/sharepoint-vulnerability-cve-2026-20963-exploited/)
- [BleepingComputer — Critical Microsoft SharePoint flaw now exploited in attacks](https://www.bleepingcomputer.com/news/microsoft/critical-microsoft-sharepoint-flaw-now-exploited-in-attacks/)
- [Truesec — CVE-2026-20963 Actively Exploited SharePoint Deserialization Vulnerability](https://www.truesec.com/hub/blog/cve-2026-20963)
- [CVEReports — CVE-2026-20963 Remote Code Execution via Insecure Deserialization](https://cvereports.com/reports/CVE-2026-20963)
- [SecurityWeek — CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-attacks-exploiting-recent-sharepoint-vulnerability/)
- [Windows Forum — CVE-2026-20963 Urgent SharePoint RCE Patch and Hunt Guide](https://windowsforum.com/threads/cve-2026-20963-urgent-sharepoint-rce-patch-and-hunt-guide-for-on-prem.396813/)
- [SentinelOne Vulnerability Database — CVE-2026-20963](https://www.sentinelone.com/vulnerability-database/cve-2026-20963/)
- [RedLegg Security Bulletin — RCE Vulnerability in Microsoft Office SharePoint](https://www.redlegg.com/blog/security-bulletin-remote-code-execution-vulnerability-in-microsoft-office-sharepoint)
- [CIRCL Vulnerability Lookup — CVE-2026-20963](https://vulnerability.circl.lu/vuln/CVE-2026-20963)
- [The Hacker News — CISA Warns of Zimbra, SharePoint Flaw Exploits](https://thehackernews.com/2026/03/cisa-warns-of-zimbra-sharepoint-flaw.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0261