CVE-2026-20963

What it actually does

This vulnerability is an unauthenticated, network-exploitable deserialization flaw in Microsoft SharePoint Server. An attacker can send crafted serialized data to a vulnerable SharePoint service and cause the server to deserialize attacker-controlled content, resulting in arbitrary code execution in the context of the SharePoint web application process. Because the CVSS vector indicates no authentication or user interaction is required, successful exploitation can provide full compromise of confidentiality, integrity, and availability of the SharePoint server and may enable follow-on credential theft, web shell deployment, lateral movement, data theft, and persistence.

Why it matters to the business

A vulnerable SharePoint server can be remotely taken over without valid credentials, creating a high-risk path to compromise documents, intranet content, authentication material, and connected Microsoft infrastructure. Because this issue is listed in CISA KEV with a remediation due date of 2026-03-21 and has active exploitation reported in the wild, organizations should treat internet-facing or partner-facing SharePoint deployments as urgent exposure. Although ransomware use is not marked in KEV, the provided threat context includes an Interlock ransomware campaign, so compromise could lead to business disruption, extortion, data theft, and interruption of collaboration services.

How an attack unfolds

An attacker first identifies a reachable Microsoft SharePoint Server instance and determines whether it appears to be an affected version or lacks the relevant security update. The attacker then sends a crafted network request containing malicious serialized data to a vulnerable SharePoint component. When the server processes the request, it deserializes attacker-controlled content and executes code on the SharePoint server. After code execution, the attacker commonly attempts to establish persistence, deploy a web shell or loader, run command interpreters through the SharePoint application pool process, dump credentials or configuration secrets, access document libraries, and move laterally to adjacent systems. In active intrusions, this type of access may be used as an initial foothold for data theft or ransomware staging, including activity associated with the reported Interlock ransomware campaign context.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-20963 for every affected Microsoft SharePoint Server deployment as soon as it is available for the deployed product branch. No exact fixed version was provided in the input, so remediation teams should use Microsoft’s official Security Update Guide and SharePoint update documentation to identify the correct cumulative/security update for each SharePoint Server version in use. Prioritize internet-facing, extranet-facing, and partner-accessible SharePoint servers. If immediate patching is not possible, restrict external access, place SharePoint behind a VPN or strong access proxy, limit access to trusted source networks, review and harden web application firewall rules, disable unnecessary SharePoint services or endpoints where operationally safe, ensure least-privilege service accounts, and increase monitoring for SharePoint process execution anomalies. Mitigations should be treated as temporary; patching remains the required fix for a KEV-listed actively exploited vulnerability.

How to confirm the fix worked

Confirm all SharePoint servers have the Microsoft security update or cumulative update that includes the fix installed. Validate the installed SharePoint build number against Microsoft’s official fixed build guidance for the deployed SharePoint edition. Re-run authenticated vulnerability scanning and configuration inventory across all SharePoint web front ends, application servers, and disaster recovery instances. Confirm that no externally reachable SharePoint endpoint remains unpatched by testing from an external vantage point or reviewing exposure management results. After patching, verify SharePoint services are healthy, search/indexing and workflow functions operate normally, and logs show no recurring deserialization-related errors or suspicious requests. If compromise is suspected, do not rely on patch validation alone; perform incident response triage for web shells, suspicious child processes, unauthorized files, and credential access artifacts.

Typical attack path

1. Scan for exposed Microsoft SharePoint Server instances over HTTP or HTTPS.
2. Fingerprint SharePoint version, patch level, response behavior, or vulnerable endpoints.
3. Send a crafted unauthenticated request containing malicious serialized data to the vulnerable SharePoint service.
4. Achieve arbitrary code execution in the SharePoint web application process context.
5. Execute discovery commands to identify host privileges, domain context, installed security tools, and stored secrets.
6. Deploy a web shell, loader, scheduled task, service, or other persistence mechanism.
7. Access SharePoint content, configuration files, service credentials, and authentication material.
8. Move laterally to file servers, identity infrastructure, databases, or other internal systems.
9. Exfiltrate data, disable defenses, or stage ransomware depending on campaign objectives.

How to detect it

To determine whether exploitation already occurred, review IIS logs for unusual unauthenticated POST requests to SharePoint endpoints, abnormal request volume, requests with large or encoded payloads, and activity from unfamiliar external IP addresses before patching. Review SharePoint ULS logs for deserialization, unexpected application errors, unsafe object processing, or request correlation IDs tied to suspicious IIS entries. Correlate Windows Security, PowerShell, Sysmon, and EDR telemetry for command execution by SharePoint worker processes, especially w3wp.exe spawning cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, wmic.exe, or script interpreters. Inspect SharePoint web directories for newly created or modified ASPX/ASHX files, particularly in layouts, control templates, images, or other web-accessible paths. Look for persistence through scheduled tasks, new services, startup items, IIS module changes, altered web.config files, or unexpected local/domain account changes. Investigate outbound connections from SharePoint servers to unfamiliar IPs, file-sharing services, paste sites, command-and-control infrastructure, or known ransomware staging infrastructure. Because threat context includes the Interlock ransomware campaign, also hunt for pre-ransomware behaviors such as discovery commands, archive creation, mass file access, credential dumping, defense tampering, and unusual remote administration tooling initiated from SharePoint servers.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning wmic.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\*.ascx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\IMAGES\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*\web.config
• C:\inetpub\wwwroot\wss\VirtualDirectories\*\*.aspx
• New-Service executed by w3wp.exe
• schtasks.exe /Create executed by w3wp.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• vssadmin.exe delete shadows
• wevtutil.exe cl
• whoami /all
• nltest /domain_trusts
• net group "Domain Admins" /domain
• tasklist /v
• quser
• cmd.exe /c whoami

What your security team should do

• Treat this as a critical, actively exploited remote code execution issue and prioritize remediation ahead of routine patch cycles, especially for internet-facing SharePoint servers.
• Use the CISA KEV due date of 2026-03-21 as the latest acceptable remediation deadline; high-exposure systems should be remediated much sooner.
• Create a complete inventory of Microsoft SharePoint Server instances, including web front ends, application servers, test systems, disaster recovery systems, and externally exposed deployments.
• Apply the relevant Microsoft security update or cumulative update for each affected SharePoint version and verify installed build numbers afterward.
• Temporarily restrict network access to SharePoint from untrusted networks where patching cannot be completed immediately.
• Hunt for evidence of prior exploitation, focusing on w3wp.exe child processes, suspicious ASPX files, unexpected PowerShell activity, new scheduled tasks or services, and anomalous SharePoint ULS/IIS log entries.
• Review SharePoint service account permissions and rotate credentials if exploitation is suspected or confirmed.
• Search for indicators consistent with Interlock ransomware campaign activity in environments where SharePoint exposure existed before remediation.
• Preserve IIS logs, SharePoint ULS logs, Windows Event Logs, EDR telemetry, and relevant memory/disk artifacts before rebuilding or cleaning potentially compromised servers.
• If web shells, unknown binaries, credential dumping, or lateral movement are found, escalate to full incident response rather than treating the event as a simple patching issue.