2026-004: Critical Vulnerability in SharePoint Exploited
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
On 17 March 2026, Microsoft updated one of its January 2026 security advisories related to a remote code execution vulnerability in Microsoft SharePoint. Specifically, Microsoft raised the CVSS score and changed the FAQ section to indicate that the vulnerability could be exploited by an unauthenticated attacker. This vulnerability was added in the CISA's Known Exploited Vulnerabilities (KEV) catalogue on 18 March 2026. Additionally, three further RCE flaws affecting Microsoft SharePoint were addressed in the March 2026 release. CERT-EU strongly recommends updating SharePoint servers as soon as possible, prioritising internet-facing assets. CERT-EU also encourages IT administrators to take necessary remediation actions.
CSIRTS triage
- What
- A remote code execution vulnerability can be exploited by unauthenticated attackers.
- Who is affected
- Deployments of Microsoft SharePoint are affected, especially internet-facing assets.
- Urgency
- Remediation is critical due to the high CVSS score and active exploitation.
- Action
- Update SharePoint servers as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch SharePoint
Get an email when a new SharePoint advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cert.europa.eu/publications/security-advisories/2026-004/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20963Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-261061.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-261130.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-261143.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 86% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20963 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-26106 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-26113 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-26114 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCVE-2026-20963: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
More from CERT-EU Security Advisories
- critical2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway2026-08-19
- critical2026-009: Critical Vulnerabilities in Microsoft SharePoint2026-07-23
- critical2026-008: Critical vulnerabilities in Ivanti Sentry2026-06-10
- critical2026-007: Critical Vulnerability in Windows Netlogon2026-06-10
- critical2026-006: Critical Vulnerability in PAN-OS2026-05-06