CVE-2021-40487: Microsoft SharePoint Server code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with high confidentiality and integrity impact and a high EPSS score, though it requires authenticated access and is not in KEV.

What it is

CVE-2021-40487 is a remote code execution vulnerability in Microsoft SharePoint Server caused by code injection (CWE-94). It matters because SharePoint is widely deployed for collaboration and document handling, and a successful exploit gives an authenticated low-privileged user code execution on the server. The record gives no detail on the specific vulnerable component or affected versions.

Impact

An attacker who can authenticate to SharePoint gains remote code execution on the server, with high impact to confidentiality and integrity. Availability is not affected per the CVSS vector.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires low privileges (PR:L), meaning the attacker needs a valid authenticated account on the SharePoint instance. No pre-existing user action is needed beyond authentication.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.48 (98.8th percentile), indicating elevated likelihood of exploitation activity. References are limited to the Microsoft patch advisory and a ZDI advisory, with no public exploit detail in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-40487 as the first action.
• Restrict and review SharePoint site membership so only users who need access hold accounts, reducing the pool of authenticated attackers who can reach the flaw.
• Enforce least privilege on SharePoint service and application pool accounts to limit what code execution achieves.
• Monitor vendor guidance and re-check the advisory for any updated affected-version or workaround information, since the record does not list versions.

Detection

• Monitor SharePoint server and IIS logs for unusual POST requests or web shell creation in SharePoint directories.
• Alert on unexpected child processes spawned by SharePoint worker processes (w3wp.exe) or the SharePoint timer service.
• Watch for new or modified files under SharePoint web application paths and layout directories.
• Correlate authentication events with subsequent anomalous server-side activity from the same account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.