CVE-2021-28474: Microsoft SharePoint Server remote code execution via interpretation conflict

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (98.9th percentile) make this a serious, likely-targeted flaw despite no KEV listing.

What it is

CVE-2021-28474 is a remote code execution vulnerability in Microsoft SharePoint Foundation and SharePoint Server, rooted in a CWE-436 interpretation conflict. An authenticated attacker with low privileges can send crafted requests over the network to execute code on the server, which matters because SharePoint is a widely deployed collaboration platform holding sensitive data.

Impact

Successful exploitation gives the attacker code execution in the context of the SharePoint server, enabling data theft, lateral movement, or further compromise of the host. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Attack surface

The flaw is reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated SharePoint user can attempt it. No details on the specific endpoint or request shape are provided in the record.

Exploitation

The record shows no CISA KEV listing and no ransomware association, but EPSS is high at roughly 0.51 (98.9th percentile), indicating elevated likelihood of exploitation activity. References are limited to the Microsoft patch advisory and a ZDI third-party advisory, with no public exploit tag.

What to do

• Apply the Microsoft security update for CVE-2021-28474 to all affected SharePoint Foundation and SharePoint Server instances.
• Restrict and audit authenticated access to SharePoint, removing unnecessary accounts and permissions.
• Place SharePoint behind network controls that limit exposure to trusted users and segments.
• Monitor vendor guidance and re-check for updated advisories, since the record lacks affected version detail.

Detection

• Review SharePoint server logs for anomalous or malformed requests from authenticated users that precede unexpected process execution.
• Alert on child processes spawned by SharePoint worker processes (for example w3wp.exe) that are not part of normal operations.
• Correlate authentication events with subsequent suspicious file writes or command execution on SharePoint hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.