SharePoint deserialization flaw patched in January now exploited, Cyber Centre says

A critical Microsoft SharePoint Server vulnerability fixed in January is now being exploited, according to CISA, which added it to its Known Exploited Vulnerabilities catalog on March 18, and the Canadian Centre for Cyber Security, which issued alert AL26-005 on March 20.

The flaw, CVE-2026-20963, is a deserialization of untrusted data bug that lets an unauthenticated remote attacker execute code on an on-premises SharePoint server. Microsoft rates it 9.8 out of 10. The Cyber Centre said it "has observed exploitation" of the vulnerability and urged organizations to take immediate action.

Why it matters

Organizations that left their January updates uninstalled have been exposed for two months to a flaw that needs no credentials. On-premises SharePoint servers, often used by governments, universities and large companies to store internal documents, have been a frequent target since the mass exploitation of the ToolShell flaws in July 2025. Successful attacks on SharePoint have typically involved web shells and theft of the server's cryptographic machine keys, which let intruders keep access even after patching.

Microsoft released the fix in its January 2026 rollup, which the Cyber Centre covered in advisory AV26-024 and updated on March 18 with details of the exploitation.

Fixed versions

• SharePoint Enterprise Server 2016: 16.0.5535.1001
• SharePoint Server 2019: 16.0.10417.20083
• SharePoint Server Subscription Edition: 16.0.19127.20442

The Cyber Centre said open-source reporting indicates older, unsupported SharePoint versions are also affected and should be decommissioned or upgraded.

What to do

• Identify every on-premises SharePoint server, especially those reachable from the internet, and confirm it is on a supported version.
• Install the January 2026 security updates or later and verify the build numbers.
• Isolate web-facing SharePoint servers and harden them as described in the Cyber Centre's Top 10 IT Security Actions.
• If a server was exposed and unpatched, look for web shells and unusual processes, and rotate ASP.NET machine keys after patching.
• Report signs of compromise through My Cyber Portal or [email protected].