CVE-2026-20963

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-209657.5Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.CVE-2026-209678.8Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-209686.7Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.CVE-2026-209695.5Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User inCVE-2026-20978.8Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute weCVE-2026-209707.8Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.CVE-2026-209717.8Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.CVE-2026-209723.3Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.CVE-2026-209739.1Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.CVE-2026-209744.6Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass CarrieCVE-2026-209755.5Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbCVE-2026-209767.8Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.
CVE-2026-20963: Critical severity, CVSS 9.8 | Vulnix