CVE-2022-35823: Microsoft SharePoint remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is network-reachable remote code execution with high confidentiality, integrity and availability impact, and EPSS is very high, though it requires authenticated access and is not in KEV.

What it is

CVE-2022-35823 is a remote code execution vulnerability in Microsoft SharePoint Server, Enterprise Server and Foundation. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact flaw class is unknown, but successful exploitation allows code execution on the SharePoint host.

Impact

An authenticated attacker can execute arbitrary code on the SharePoint server, gaining the privileges of the affected service or application pool. That can lead to full compromise of the SharePoint farm and any data or credentials it holds.

Attack surface

The CVSS vector is network-reachable (AV:N) with low attack complexity and no user interaction, but it requires low privileges (PR:L), meaning the attacker needs some valid authenticated access to the target. No specific endpoint or feature is identified in the record.

Exploitation

The CVE is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.54 (99th percentile), indicating elevated predicted exploitation activity. The references carry no exploit tags, so active exploitation is not confirmed by this record.

What to do

• Apply the Microsoft security update for CVE-2022-35823 to all affected SharePoint Server, Enterprise Server and Foundation installations.
• Restrict and audit authenticated access to SharePoint, removing unnecessary accounts and permissions that could satisfy the low-privilege requirement.
• Segment SharePoint servers from untrusted networks and limit inbound access to required users and services.
• Monitor Microsoft advisories for updated guidance and any revised affected-product or version details.

Detection

• Monitor SharePoint server processes for unexpected child processes or command execution originating from web-facing components.
• Review SharePoint and IIS logs for anomalous authenticated requests, especially from accounts with low privileges.
• Alert on unusual file writes or new executables appearing in SharePoint web directories or application paths.
• Correlate authentication events with post-auth process creation on SharePoint hosts to catch exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.