PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Phân tích CVE-2026-20963

blog.viettelcybersecurity.com | vulnerability | CVE-2026-20963 | #rce | #deserialization | #sharepoint | #patch-analysis | #safecontrols | #cve-2026-20963
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A diff-based analysis of SharePoint CVE-2026-20963 shows the KB5002825 patch hardened Register Directive parsing, which attackers could abuse to bypass SafeControls checks and reach RCE.
CVE
CVE-2026-20963
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
CVE-2026-20963 Analysis
CVE-2026-20963: inconsistently normalized TagPrefix values in Register Directives let HTML-encoded whitespace slip past SharePoint SafeControls validation; fixed in the KB5002825 update.
vulnerability · blog.viettelcybersecurity.com
Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE
A patch-diff analysis of CVE-2022-22005 (CVSS 8.8), a SharePoint RCE, tracing Microsoft's fix to a serialization binder restricting types during ChartPreviewImage.loadChartImage() deserialization.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
vulnerability · blog.viettelcybersecurity.com
SharePoint ToolShell – One Request PreAuth RCE Chain
The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
vulnerability · blog.viettelcybersecurity.com
SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization
CVE-2024-38018: SPSerializationBinder allowed binary deserialization of SafeControls classes via WebPart attached properties, enabling RCE with a crafted ysoserial payload.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-22005 Microsoft Sharepoint RCE
Patch analysis of CVE-2022-22005, an RCE in Microsoft SharePoint (CVSS 8.8): diffing SharePoint 2016 builds pinpoints unsafe deserialization in ChartPreviewImage.loadChartImage().
Back