{"id":225108,"date":"2026-03-18T17:12:00","date_gmt":"2026-03-18T21:12:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/03\/18\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog\/"},"modified":"2026-03-18T18:15:12","modified_gmt":"2026-03-18T22:15:12","slug":"u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/03\/18\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog\/","title":{"rendered":"U.S. CISA adds Microsoft SharePoint and Zimbra\u00a0 flaws to its Known Exploited Vulnerabilities catalog"},"content":{"rendered":"<p><a href=\"https:\/\/securityaffairs.com\/189628\/security\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog.html\">U.S. CISA adds Microsoft SharePoint and Zimbra\u00a0 flaws to its Known Exploited Vulnerabilities catalog<\/a><\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/189628\/security\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog.html\">https:\/\/securityaffairs.com\/189628\/security\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-03-18 17:12:00<\/a><\/p>\n<p>Source Domain: <a href=\"securityaffairs.com\">securityaffairs.com<\/a><\/p>\n<p><h2>U.S. CISA adds Microsoft SharePoint and Zimbra\u00a0 flaws to its Known Exploited Vulnerabilities catalog<\/h2>\n<\/p>\n<p>\t\t\t\t\t\t\t<span> Pierluigi Paganini<\/span><br \/>\n\t\t\t\t\t\t\t<span><img decoding=\"async\" src=\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\" alt=\"\"\/> March 18, 2026<\/span><\/p>\n<p>\t\t\t\t\t\t<img decoding=\"async\" class=\"img-fluid mb-4\" src=\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2020\/07\/CISA.jpeg?fit=700%2C368&#038;ssl=1\" alt=\"\"\/><\/p>\n<h2 class=\"wp-block-heading\">U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog.<\/h2>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added ([1, 2]) SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog.<\/p>\n<p>Below are the flaws added to the catalog:<\/p>\n<ul class=\"wp-block-list\">\n<li>CVE-2026-20963\u00a0(CVSS score of 8.8) \u2013 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability;<\/li>\n<li>CVE-2025-66376 (CVSS score of 7.2) \u2013 \u00a0Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability;<\/li>\n<\/ul>\n<p>The first vulnerability added to the catalog, tracked as CVE-2026-20963, is a deserialization of untrusted data in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network.<\/p>\n<p>\u201cIn a network-based attack, an unauthenticated attacker could write arbitrary code to inject and execute code remotely on the SharePoint Server.\u201d reads the advisory.<\/p>\n<p>The second flaw added to the KeV catalog, tracked as CVE-2025-66376, is a stored XSS vulnerability in the Classic UI where\u00a0attackers could abuse CSS @import directives in email HTML.<\/p>\n<p>According to\u00a0Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/p>\n<p>Experts also recommend that private organizations review the\u00a0Catalog\u00a0and address the vulnerabilities in their infrastructure.<\/p>\n<p>CISA orders federal agencies to fix the vulnerability CVE-2026-20963 by\u00a0March 21, 2026 and the flaw CVE-2025-66376 by\u00a0April 1st, 2026.<\/p>\n<p><strong>Follow me on&#8230;<\/strong><\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/189628\/security\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>U.S. CISA adds Microsoft SharePoint and Zimbra\u00a0 flaws to its Known Exploited Vulnerabilities catalog https:\/\/securityaffairs.com\/189628\/security\/u-s-cisa-adds-microsoft-sharepoint-and-zimbra-flaws-to-its-known-exploited-vulnerabilities-catalog.html&#8230;<\/p>\n","protected":false},"author":1,"featured_media":225109,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/securityaffairs.com\/wp-content\/uploads\/2020\/07\/CISA.jpeg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,27],"class_list":["post-225108","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/225108"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=225108"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/225108\/revisions"}],"predecessor-version":[{"id":225110,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/225108\/revisions\/225110"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/225109"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=225108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=225108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=225108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}