NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Microsoft SharePoint code-execution flaw CVE-2026-20963 used in attacks; January fixes available

Attackers are exploiting CVE-2026-20963 to run code on unpatched SharePoint servers without signing in. Microsoft released fixes in January for Server 2016, 2019 and Subscription Edition. Ask your IT provider to update and check exposed servers for compromise.

What to do

If your business or family office runs SharePoint Server, ask IT to install the latest security updates, including at least KB5002828 for 2016, KB5002825 for 2019 or KB5002822 for Subscription Edition. Ask them to check internet-facing servers for compromise and replace unsupported installations. There is no update to install on your personal phone or computer for this server flaw.

What’s happening

CVE-2026-20963 is a flaw in how Microsoft SharePoint Server processes untrusted data, allowing an attacker to run code over a network without signing in. It affects organisation-run SharePoint Enterprise Server 2016, Server 2019 and Subscription Edition below the fixed builds listed here. Microsoft released fixes for all three editions on 13 January 2026. On 17 March, it revised its assessment to clarify that no login was required and raised the score to 9.8. CISA confirmed exploitation through its catalogue listing on 18 March, and Canada's Cyber Centre subsequently said it had observed attacks. CERT-EU recommended both updating and checking exposed servers for compromise. As of 3 November, fixes remain available for all three editions; the reviewed sources do not establish that attacks have ended or identify their scale, victims or operators. Legacy installations without security support should be upgraded or retired.

What
Flaw
Affects
Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition
Affected
Microsoft SharePoint Enterprise Server 2016: 16.0.0 before 16.0.5535.1001
Microsoft SharePoint Server 2019: 16.0.0 before 16.0.10417.20083
Microsoft SharePoint Server Subscription Edition: 16.0.0 before 16.0.19127.20442
Fixed in
Microsoft SharePoint Enterprise Server 2016: 16.0.5535.1001 (KB5002828)
Microsoft SharePoint Server 2019: 16.0.10417.20083 (KB5002825)
Microsoft SharePoint Server Subscription Edition: 16.0.19127.20442 (KB5002822)
CVE
CVE-2026-20963
Since
18 Mar 2026
Closed
25 Mar 2026

Timeline

  1. Update

    CERT-EU urged prompt patching, prioritising internet-facing servers, and recommended checking exposed servers for compromise. As precautions, it also recommended stronger malware scanning, endpoint monitoring and rotation of SharePoint machine keys after updating.

  2. Update

    Canada's Cyber Centre said it had observed exploitation itself. It listed fixed builds for all three affected editions and urged organisations to update their servers.

  3. CISA added

    CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to address it by 21 March. Public details about the attackers and victims were not provided.

  4. Vendor revised

    Microsoft revised its advisory to explain that attackers did not need to sign in and raised the severity score to 9.8, according to CERT-EU. This changed the assessment of the flaw, rather than introducing a new fix.

  5. New fixFixed

    Microsoft released January security updates addressing CVE-2026-20963. The Subscription Edition fix was KB5002822, build 16.0.19127.20442; fixes were also released for SharePoint Server 2016 and 2019.

Sources

  1. Description of the security update for SharePoint Server 2016: January 13, 2026 (KB5002828)Microsoft · 13 Jan 2026
  2. Description of the security update for SharePoint Server 2019: January 13, 2026 (KB5002825)Microsoft · 13 Jan 2026
  3. Description of the security update for SharePoint Server Subscription Edition: January 13, 2026 (KB5002822)Microsoft · 13 Jan 2026
  4. Critical Vulnerability in SharePoint ExploitedCERT-EU · 25 Mar 2026
  5. AL26-005 – Critical vulnerability impacting Microsoft SharePoint Server – CVE-2026-20963Canadian Centre for Cyber Security · 20 Mar 2026
  6. Critical Microsoft SharePoint flaw now exploited in attacksBleepingComputer · 19 Mar 2026
  7. CISA Warns of Attacks Exploiting Recent SharePoint VulnerabilitySecurityWeek · 20 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS