This is not a story about a sophisticated cyberattack. It’s a story about leaving the front door open for two months and then acting surprised when someone walks in.
On March 18, CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalog, confirming that attackers are actively using a critical SharePoint Server flaw to execute remote code on enterprise systems. The vulnerability carries a CVSS score of 9.8 out of 10. It affects SharePoint Server 2016, 2019, and Subscription Edition, according to Microsoft’s security advisory.
Microsoft patched it in January.
That’s not a typo. The fix shipped with the January 2026 Patch Tuesday update, more than two months ago. At the time, Microsoft’s own assessment rated the flaw as “less likely” to be exploited, according to Bleeping Computer’s coverage. That assessment aged poorly.
How It Works
The vulnerability is a textbook deserialization attack. SharePoint uses serialization to maintain state across HTTP requests, frequently through ASP.NET ViewState. The server serializes data, sends it to the client, and trusts what comes back. CVE-2026-20963 exploits the fact that SharePoint’s deserialization logic doesn’t properly validate the type of incoming data, according to CVE Reports’ technical breakdown.
An attacker crafts a malicious serialized payload, sends it to a vulnerable server, and SharePoint executes whatever instructions are embedded in it. No valid credentials required. No user interaction needed. The attack complexity is low, per CISA’s assessment.
That gets you full remote code execution on the SharePoint server. Most large enterprises use SharePoint as their document management backbone, so a successful exploit opens up internal communications, sensitive files, HR documents, financial records. Everything the server touches.
The Pattern Nobody Learns From
SharePoint deserialization vulnerabilities are not new. This is the third major one in three years.
CVE-2023-29357 was a privilege escalation flaw that CISA added to its KEV catalog in January 2024 after active exploitation, according to Picus Security’s analysis. CVE-2024-38094 was another deserialization RCE, CVSS 7.2, added to the KEV catalog in October 2024 after attackers used it to gain initial access, install malware, disable security tools, and move laterally across victim networks, according to The Hacker News.
Same product. Same class of vulnerability. Same outcome: organizations that didn’t patch fast enough got compromised.
Shodan scans from late 2025 identified over 16,000 SharePoint servers directly exposed to the internet, with the United States hosting the largest concentration at nearly 4,000 instances, according to SOCRadar’s exposure analysis. Not all of these are vulnerable, but every unpatched one is a target.
Two Months Is Not a Zero-Day
CISA has given federal agencies until March 21 to patch or mitigate, under Binding Operational Directive 22-01, which mandates remediation within specific timeframes once a vulnerability hits the KEV catalog. Private sector organizations face no such mandate. They get a strong recommendation and nothing else.
But even that framing lets people off the hook. BOD 22-01 kicked in on March 18. The patch was available since January 14. Any organization running on-premises SharePoint had 63 days to apply a critical security update and didn’t.
There are real reasons patching is hard. SharePoint is deeply integrated into enterprise workflows. Testing patches against custom configurations takes time. Change management boards move slowly. IT teams are understaffed and juggling a dozen other priorities.
All of that is true, and none of it matters to the attacker who just got remote code execution on your file server.
The Uncomfortable Math
Enterprise security has a measurement problem. CISOs report on vulnerability counts, patch compliance percentages, mean time to remediate. These numbers go into dashboards. Dashboards go into board presentations. Everyone nods.
Meanwhile, the same class of deserialization bug in the same product keeps getting exploited because the same organizations keep failing to patch within any reasonable window. Microsoft ships a fix. CISA eventually adds it to KEV when exploitation is confirmed. Federal agencies scramble to meet a deadline. Private sector organizations patch whenever they get around to it.
This cycle repeats every few months. The specific CVE number changes. The outcome doesn’t.
The uncomfortable truth is that most enterprise breaches in 2026 are not the result of brilliant hacking. They’re the result of known vulnerabilities with available patches that nobody applied. Not because the patches didn’t exist. Because patching wasn’t treated as urgent until CISA made it urgent, which in this case was two months after Microsoft already said “hey, you should probably fix this.”
CVE-2026-20963 is not a story about a dangerous new exploit. It’s a story about institutional inertia. The fix was there. The warning was there. The pattern from previous SharePoint CVEs was there. And the door stayed open anyway.
What You Should Actually Do
If you are an everyday consumer: This one probably does not affect you directly. SharePoint is enterprise software. But the principle applies to everything you use. If your phone, laptop, or router has a pending security update, install it. The most common path into your digital life is a vulnerability you knew about and did not patch. Turn on automatic updates for everything.
If you run a small or mid-sized business: Check whether you are running SharePoint on-premises. Many SMBs migrated to SharePoint Online through Microsoft 365, which Microsoft patches automatically. If you are still running SharePoint Server 2016, 2019, or Subscription Edition on your own hardware, you need to apply the January 2026 Patch Tuesday update immediately. If you do not have an IT team that monitors CVEs, this is the kind of thing that slips through. Consider whether your organization has the capacity to maintain on-prem infrastructure securely, or whether a managed cloud migration makes more sense long-term.
If you are an enterprise: You know the drill, and that is part of the problem. Your change management process, testing pipeline, and approval boards are designed to prevent disruption. They also prevent speed. A 63-day window between patch availability and confirmed exploitation is a failure, not a reasonable timeline. The question for every CISO reading this: if the same class of vulnerability in the same product has been exploited three times in three years, why is the patching timeline still measured in months?
—
Lamar covers cybersecurity, enterprise tech, and the systems that shape how power and technology interact. Follow Laterstack for critical analysis of the stories that matter.