Critical Microsoft SharePoint flaw now exploited in attacks

CISA warns that a critical SharePoint vulnerability (CVE-2026-20963), patched by Microsoft in January, is being exploited in the wild and can allow unauthenticated remote code execution via deserialization on unpatched SharePoint Server instances; CISA has added the flaw to its catalog of actively exploited vulnerabilities and ordered federal civilian agencies to remediate, while also flagging an actively exploited stored XSS in Zimbra.