A vulnerability in Microsoft SharePoint Server is being actively exploited. A patch has been available since January.
The U.S. cybersecurity agency CISA has labeled a vulnerability in Microsoft SharePoint as ‘actively exploited.’ The vulnerability, identified as CVE-2026-20963, affects locally hosted SharePoint Server configurations. This includes Enterprise Server 2016, 2019, and the Subscription Edition, as well as older versions that are no longer supported. It is unclear whether attacks are also occurring in Europe.
The vulnerability stems from a deserialization error that can grant an attacker elevated privileges to execute malicious code. Microsoft rolled out a patch in January to fix the leak, but for locally hosted SharePoint environments, it is the administrator’s responsibility to deploy it. Unfortunately, in practice, this still does not always happen in a timely manner.
Microsoft has not yet communicated regarding active abuse, but the U.S. CISA has placed the vulnerability in its catalog. The government organization requests that available patches be installed as soon as possible. “This type of vulnerability represents a common attack vector for malicious cyber actors and poses significant risks,” according to CISA.
An annual tradition
When the words ‘SharePoint’ and ‘vulnerability’ appear in the same sentence, all alarm bells go off. On-premises SharePoint environments are regular targets for hackers. Malicious actors assume that companies managing their own environments are lagging behind on installing updates. In practice, this is still often the case, and partly for these reasons, Microsoft is trying to move as many companies as possible to the cloud version.
Last summer, a zero-day in SharePoint held organizations worldwide in its grip. Vulnerable servers were under fire for weeks. Microsoft quickly rolled out a patch then as well, but it initially proved insufficient. How widespread this vulnerability and its exploitation are should become clear in the coming days and weeks.