CVE-2026-20963 Splunk · SPL

Detect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-20963) in Splunk

Detects exploitation of CVE-2026-20963, a deserialization of untrusted data vulnerability in Microsoft SharePoint. Attackers can send crafted serialized payloads to SharePoint endpoints, leading to remote code execution in the context of the SharePoint application pool. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent=lower(ParentImage), proc=lower(Image), cmdline=lower(CommandLine)
| where (parent="*w3wp.exe*" AND proc IN ("*powershell.exe*", "*cmd.exe*", "*wscript.exe*", "*cscript.exe*", "*mshta.exe*", "*certutil.exe*"))
   OR (EventCode=4688 AND parent="*w3wp.exe*" AND proc IN ("*powershell.exe*", "*cmd.exe*"))
| eval risk_reason=case(
    match(proc, "powershell"), "PowerShell spawned from IIS worker",
    match(proc, "certutil"), "certutil spawned from IIS worker - possible payload download",
    match(proc, "mshta"), "mshta spawned from IIS worker - possible script execution",
    true(), "Suspicious child process of w3wp.exe"
)
| table _time, host, parent, proc, cmdline, risk_reason
| sort -_time
critical severity high confidence

Detects SharePoint IIS worker process spawning suspicious child processes on Windows hosts, which is a strong indicator of successful deserialization exploitation.

Data Sources

Windows Security Event LogSysmon

Required Sourcetypes

WinEventLog:SecurityXmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • SharePoint workflow activities that legitimately spawn PowerShell for data processing
  • Administrative tooling running under application pool identity
  • Security scanning tools executing under IIS context

Other platforms for CVE-2026-20963

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate SharePoint Deserialization Child Process Spawn

    Expected signal: Process creation event (Event ID 4688 or Sysmon Event ID 1) with ParentImage matching w3wp_sim.exe and Image matching powershell.exe

  2. Test 2Craft and Submit Malformed Serialized Payload to SharePoint Endpoint

    Expected signal: IIS access log entry showing POST to /_api/web/lists with non-JSON content-type or anomalous body size; WAF or SIEM alert on malformed serialized content

  3. Test 3Simulate Credential Dumping Post-Exploitation via w3wp.exe Context

    Expected signal: Process creation event showing cmd.exe or tasklist.exe executed under SharePoint application pool identity; Event ID 4656/4663 if LSASS handle access is attempted

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm whether the affected SharePoint server is patched for CVE-2026-20963 by checking the installed SharePoint update level against Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963.
  2. Review IIS logs on the SharePoint server for anomalous POST requests to /_api/, /_layouts/, or /_vti_bin/ endpoints around the time of the alert, paying attention to unusually large request bodies or unexpected content-types.
  3. Identify the child process spawned by w3wp.exe: capture its full command line, loaded modules, and network connections established immediately after launch to determine attacker intent (reconnaissance, lateral movement, data exfiltration).
  4. Correlate the source IP of suspicious HTTP requests against known threat actor infrastructure and internal asset inventory to assess whether this is an internal or external origin.

Containment

  1. Isolate the affected SharePoint server from the network at the firewall or EDR level immediately if active exploitation is confirmed, to prevent lateral movement or further command-and-control activity.
  2. Revoke application pool identity credentials and rotate service account passwords for all SharePoint-related service accounts, particularly those with domain privileges, to prevent credential reuse.

Evidence Collection

  1. Collect full IIS access logs, application event logs, and Windows Security event logs (Event IDs 4624, 4688, 4698, 7045) from the affected SharePoint host covering at minimum 48 hours prior to detection.
  2. Capture a memory image of the w3wp.exe process and any spawned child processes using tools such as WinPmem or ProcDump before remediation to preserve forensic evidence of the injected payload.

Escalation Criteria

  • !Escalate immediately if the spawned process establishes outbound network connections to external IPs, indicating active C2 communication or data exfiltration.
  • !Escalate if the compromised SharePoint application pool account is a domain service account with elevated privileges, as this significantly expands the blast radius.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS logs at C:\inetpub\logs\LogFiles\W3SVC* containing anomalous POST requests with large bodies or unusual user-agents to SharePoint API endpoints
  • >Windows event ID 4688 (process creation) entries showing w3wp.exe as parent of PowerShell, cmd.exe, or other LOLBins
  • >Prefetch files for any processes spawned by w3wp.exe, located at C:\Windows\Prefetch\, confirming execution history

Tuning Guidance

Tune by adding known SharePoint maintenance windows and authorized automation service account names to an exclusion list. If your organization uses SharePoint workflows that legitimately invoke PowerShell, capture those specific command-line patterns and exclude them. Consider reducing false positives further by adding a network connection filter — alert only when the child process also establishes an external connection within 60 seconds of spawn. Raise confidence threshold on detections where the child process is certutil.exe or mshta.exe, as these have very limited legitimate use under w3wp.exe.

Hunting Queries

Hunt for outbound network connections initiated by processes whose parent is the SharePoint IIS worker process (w3wp.exe), which may indicate successful exploitation and C2 beaconing.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessParentFileName =~ "w3wp.exe"
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where ConnectionCount > 0
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=sysmon EventCode=3
| where ParentImage LIKE "%w3wp.exe%"
| where NOT (dest_ip LIKE "10.%" OR dest_ip LIKE "192.168.%" OR dest_ip LIKE "172.16.%")
| stats count by host, Image, CommandLine, dest_ip, dest_port
| sort -count

Atomic Red Team Tests

Test 1 Simulate SharePoint Deserialization Child Process Spawn
windows

Simulates the post-exploitation behavior of CVE-2026-20963 by directly launching PowerShell as a child of a renamed w3wp.exe copy, triggering process-lineage-based detections without exploiting a real SharePoint instance.

Command

powershell 
Copy-Item "$env:SystemRoot\System32\inetsrv\w3wp.exe" -Destination "$env:TEMP\w3wp_sim.exe"; Start-Process "$env:TEMP\w3wp_sim.exe" -ArgumentList "-ap \"SharePoint - 80\"" -PassThru | ForEach-Object { Start-Sleep 2; Start-Process powershell.exe -ArgumentList "-NoProfile -Command whoami" }

Cleanup

powershell 
Remove-Item "$env:TEMP\w3wp_sim.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Process creation event (Event ID 4688 or Sysmon Event ID 1) with ParentImage matching w3wp_sim.exe and Image matching powershell.exe

Expected Detection

Alert: SharePoint worker spawned suspicious child process — PowerShell spawned from IIS worker

Test 2 Craft and Submit Malformed Serialized Payload to SharePoint Endpoint
linux

In a lab SharePoint environment, sends a crafted HTTP POST with a malformed BinaryFormatter serialized payload to a SharePoint API endpoint to test WAF and application-layer detections. Does not achieve RCE unless a vulnerable SharePoint version is present.

Command

bash 
python3 -c "
import requests, base64
payload = b'\x00\x01\x00\x00\x00\xff\xff\xff\xff\x01\x00\x00\x00\x00\x00\x00\x00\x0c\x02\x00\x00\x00'
payload_b64 = base64.b64encode(payload).decode()
headers = {'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0'}
r = requests.post('http://SHAREPOINT_LAB_HOST/_api/web/lists', headers=headers, data=payload, verify=False, timeout=10)
print(r.status_code, r.text[:200])
"

Cleanup

bash 
No cleanup required — HTTP request only, no persistent artifacts

Expected Telemetry

IIS access log entry showing POST to /_api/web/lists with non-JSON content-type or anomalous body size; WAF or SIEM alert on malformed serialized content

Expected Detection

IIS log anomaly detection or WAF rule triggering on BinaryFormatter magic bytes in HTTP body

Test 3 Simulate Credential Dumping Post-Exploitation via w3wp.exe Context
windows

Simulates the follow-on credential dumping behavior an attacker might perform after exploiting CVE-2026-20963, by running a LSASS memory access attempt from a process mimicking the SharePoint worker identity.

Command

powershell 
runas /user:$env:COMPUTERNAME\SharePointAppPool "cmd.exe /c tasklist /fi 'imagename eq lsass.exe' && echo LSASS_ACCESS_SIMULATED"

Cleanup

powershell 
No persistent changes — command output only

Expected Telemetry

Process creation event showing cmd.exe or tasklist.exe executed under SharePoint application pool identity; Event ID 4656/4663 if LSASS handle access is attempted

Expected Detection

Credential access alert: SharePoint service account attempting LSASS enumeration post-exploitation

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1003OS Credential Dumping

Same Tactic: Initial Access

Popular Detections