CVE-2026-20963: Microsoft SharePoint Deserialization -- Unauthenticated Network RCE

Background

Microsoft SharePoint Server is the enterprise content management and collaboration platform deployed at tens of thousands of organisations worldwide for document management, intranet portals, workflow automation, and team collaboration. On-premises SharePoint deployments are commonly internet-facing for remote worker access, and SharePoint Server typically has privileged access to SQL Server databases containing sensitive business documents and metadata.

SharePoint has a long history of severe vulnerabilities, including CVE-2024-38094 (deserialization RCE, actively exploited) and the ProxyShell chain. The platform’s complexity — a large .NET application with extensive serialisation usage for caching, session management, and data transfer — makes it a recurring deserialization target. CVE-2026-20963 follows this pattern; CISA added it to the KEV catalogue on 2026-03-18.

Technical Mechanism

CVE-2026-20963 is a .NET deserialization vulnerability in Microsoft SharePoint Server. .NET deserialization vulnerabilities, like their Java equivalents, arise when an application deserialises attacker-controlled data (typically via BinaryFormatter, LosFormatter, ObjectStateFormatter, or similar .NET serialisers) without sufficient type constraints.

The attack exploits known .NET deserialization gadget chains — sequences of type constructions and method calls that, when triggered during deserialisation, result in arbitrary command execution:

1. The attacker identifies a SharePoint endpoint that accepts serialised data, potentially in ViewState, session data, or a web service payload
2. A malicious serialised .NET object graph is crafted using tools like ysoserial.net, which generates payloads targeting common .NET gadget chains (e.g., TypeConfuseDelegate, RolePrincipal, WindowsIdentity)
3. The payload is submitted to the vulnerable endpoint — notably without requiring authentication (“unauthorized attacker” per Microsoft’s classification)
4. SharePoint deserialises the payload, triggering the gadget chain
5. The gadget chain executes an OS command under the SharePoint application pool identity (typically the SharePoint service account, often with domain-level privileges)

The “over a network” attack vector and lack of authentication requirement makes this directly exploitable from the internet against any exposed SharePoint instance.

Real-World Exploitation Evidence

CVE-2026-20963 was added to CISA KEV on 2026-03-18. The broader SharePoint exploitation context is well-established:

• Ransomware operators have targeted SharePoint for initial access given its common internet exposure and high-value document stores; CVE-2024-38094 saw rapid exploitation by ransomware groups in late 2024
• APT groups — Chinese state-sponsored groups, including clusters tracked as Volt Typhoon, have targeted SharePoint in campaigns against government and critical infrastructure, using it as an initial access vector for long-term access
• Data exfiltration — SharePoint stores sensitive business, legal, financial, and technical documents; initial access often leads to bulk exfiltration before or instead of ransomware deployment
• Internet-facing SharePoint is one of the most consistently targeted on-premises Microsoft services given the large installed base and frequent public exposure

Impact Assessment

Exploitation of CVE-2026-20963 gives an unauthenticated network attacker code execution under the SharePoint application pool identity, which in most enterprise deployments runs as a domain service account with elevated Active Directory privileges. From this position, an attacker can read and exfiltrate all documents stored in SharePoint, pivot to the underlying SQL Server instance housing SharePoint content databases, and use the service account’s domain credentials to move laterally into the broader Active Directory environment. No user interaction is required, meaning exploitation can occur against any internet-exposed SharePoint instance without any victim action.

The business impact is high across a wide range of sectors because SharePoint is a primary repository for sensitive documents: legal contracts, financial reports, HR records, intellectual property, and strategic plans. A successful attack typically results in bulk exfiltration before any other action is taken, with data potentially held for extortion or sold to competitors or foreign intelligence services. For organisations where SharePoint underpins intranet workflows and approval processes, the secondary disruption of those operations during incident response compounds the initial damage.

Affected Versions

Consult Microsoft’s Security Update Guide for CVE-2026-20963 for definitive affected product and version information.

Remediation Steps

1. Apply Microsoft’s security update via Windows Update or Microsoft Update Catalog immediately
2. If patching is delayed, consider disabling external access to SharePoint until the patch can be applied
3. Enable ViewState MAC validation and ensure the MachineKey configuration uses strong, unique values (reduces some deserialization attack surfaces)
4. Restrict SharePoint to internal network access where business requirements permit
5. Review SharePoint Unified Logging System (ULS) logs for unusual requests or error patterns
6. Check for new accounts in SharePoint and Active Directory
7. Audit SharePoint for recently added or modified web parts, site scripts, or SharePoint Framework solutions
8. Review the SharePoint server’s IIS logs for requests containing large binary payloads to unexpected endpoints
9. If SharePoint has write-access to file systems or SQL Server, audit those for unexpected modifications

Detection Guidance

SharePoint ULS Logs — located in %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\XX\LOGS\. Look for:

• Deserialisation exceptions or unusual .NET type loading in correlation with inbound HTTP requests
• Requests to /_vti_bin/, /_layouts/, or ViewState-bearing requests from unexpected IP addresses

IIS logs (W3SVC):

• Large HTTP POST requests to SharePoint endpoints from unknown IP addresses
• HTTP 200 responses to requests with anomalous Content-Type headers

Windows Event Logs:

• Event ID 4688: New process creation spawned by the SharePoint application pool worker process (w3wp.exe)
• Event ID 4720/4732: New user accounts or group membership changes

SIEM query example (Splunk):

index=iis_logs cs_host="*sharepoint*"
| where cs_method="POST" AND sc_bytes > 50000
| where NOT match(cs_uri_stem, "\.(aspx|ashx)$")
| stats count by c_ip, cs_uri_stem, cs_bytes, sc_status
| where sc_status=200
| sort -count

Timeline

References

• NVD — CVE-2026-20963
• CISA KEV — CVE-2026-20963
• Microsoft MSRC — CVE-2026-20963