Critical Vulnerability - Microsoft SharePoint Server Alert

The Flaw

A critical vulnerability, tracked as CVE-2026-20963, has been identified in Microsoft SharePoint Server. This flaw involves Deserialization of Untrusted Data (CWE-502) and affects multiple versions of the software. The Canadian Centre for Cyber Security has reported that this vulnerability is currently being exploited by attackers, allowing them to execute code remotely without authentication. The urgency of this situation cannot be overstated, as organizations using affected versions are at significant risk.

The vulnerability was first acknowledged in a Microsoft security advisory released on January 13, 2026, and has since been updated with further details. As of March 18, 2026, it was added to the CISA's Known Exploited Vulnerabilities catalog, highlighting its critical nature and the need for immediate action.

What's at Risk

Organizations running vulnerable versions of Microsoft SharePoint Server are at high risk of unauthorized access and potential data breaches. The affected products include:

• Microsoft SharePoint Enterprise Server 2016: Versions before 16.0.5535.1001
• Microsoft SharePoint Server 2019: Versions before 16.0.10417.20083
• Microsoft SharePoint Server Subscription Edition: Versions before 16.0.19127.20442

Legacy versions, which are no longer supported, are also impacted and should be decommissioned or upgraded. The potential for widespread exploitation makes this vulnerability particularly dangerous for organizations that rely on SharePoint for collaboration and document management.

Patch Status

Organizations are strongly urged to upgrade their SharePoint instances to the fixed versions as soon as possible. The Cyber Centre has outlined the following recommended actions:

• Identify all on-premises SharePoint Server instances, especially those exposed to the internet.
• Upgrade to the supported versions of Microsoft SharePoint Server.
• Apply the latest security updates from Microsoft promptly.

These steps are crucial to mitigate the risk posed by this vulnerability and to protect sensitive information from unauthorized access.

Immediate Actions

To safeguard against potential exploitation, organizations should implement the Cyber Centre's Top 10 IT Security Actions. Key focus areas include:

• Patching: Regularly update operating systems and applications to close security gaps.
• Hardening: Strengthen the security posture of operating systems and applications.
• Isolation: Ensure that web-facing applications are isolated from internal networks.

If any suspicious activity related to this vulnerability is detected, organizations should report it through the Cyber Centre's My Cyber Portal or contact them directly via email. Taking these proactive measures is essential to maintaining cybersecurity integrity in the face of this critical threat.