U.S. CISA adds Microsoft SharePoint and Zimbra  flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ([1, 2]) SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the flaws added to the catalog:

• CVE-2026-20963 (CVSS score of 8.8) – Microsoft SharePoint Deserialization of Untrusted Data Vulnerability;
• CVE-2025-66376 (CVSS score of 7.2) –  Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability;

The first vulnerability added to the catalog, tracked as CVE-2026-20963, is a deserialization of untrusted data in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network.

“In a network-based attack, an unauthenticated attacker could write arbitrary code to inject and execute code remotely on the SharePoint Server.” reads the advisory.

- Advertisement -

EXPLORE MORE

Missing Juvenile Nayely Rodriguez from the 2nd District

The Philadelphia Police Department is asking for the public’s assistance in locating…

U.S. CISA adds Apple, Rockwell, and Hikvision  flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple, Rockwell, and Hikvision flaws…

Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations

Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across…

Middle east crisis prompts UK NCSC warning on potential Iranian cyber activity

UK’s NCSC warns of potential Iranian cyberattacks as Middle East tensions rise,…

Wanted: Suspects for Homicide in the 2nd District [VIDEO]

The Philadelphia Police Department Homicide Unit is looking to identify the two…

Diocese establishes FSSP chaplaincy to serve faithful devoted to Latin Mass

(LifeSiteNews) — The Diocese of Arlington, Virginia, under Bishop Michael Burbidge announced last…

The second flaw added to the KeV catalog, tracked as CVE-2025-66376, is a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability CVE-2026-20963 by March 21, 2026 and the flaw CVE-2025-66376 by April 1st, 2026.

Pierluigi Paganini