Microsoft · SharePoint Server
CVE-2023-24955
Microsoft SharePoint Server Remote Code Execution Vulnerability
Exploited in attacks
Used by ransomware
High 7.2 Attack chance: 85%
What it is
Microsoft SharePoint Server Remote Code Execution Vulnerability
CISA: Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: April 16, 2024
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 14, 2026 | Missing Authentication for Critical Function | SharePoint Server | Medium 5.3 | 1.0% |
| Jul 1, 2026 | Deserialization of Untrusted Data | SharePoint Server | High 8.8 | 80% |
| Apr 14, 2026 | Improper Input Validation | SharePoint Server | Medium 6.5 | 43% |
| Jan 10, 2024 | Privilege Escalation | SharePoint Server | Critical 9.8 | >99.9% |
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.