CVE-2022-38053: Microsoft SharePoint Server remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable RCE in SharePoint with a very high EPSS score, tempered only by the low-privilege authentication requirement and lack of KEV listing.

What it is

CVE-2022-38053 is a remote code execution vulnerability in Microsoft SharePoint Server, SharePoint Enterprise Server and SharePoint Foundation. The record gives no root-cause detail beyond the CWE being listed as insufficient information, so the exact flaw class is unknown. It matters because a network-reachable RCE in a widely deployed collaboration platform can give an authenticated attacker full control of the server.

Impact

An attacker who can reach the service can execute arbitrary code on the SharePoint server, gaining high confidentiality, integrity and availability impact. In practice that means control of the host and any data or credentials it can reach.

Attack surface

The CVSS vector is network-reachable (AV:N) with low attack complexity and no user interaction, but it requires low privileges (PR:L), so the attacker needs some authenticated access to the SharePoint environment. No details on the specific endpoint or component are provided.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.764 (99.5th percentile), indicating strong predicted exploitation activity. The only references are Microsoft's advisory and patch pages, with no public exploit or PoC tags.

What to do

• Apply the Microsoft security update for CVE-2022-38053 as soon as possible; this is the primary fix.
• If patching cannot be immediate, restrict network access to SharePoint servers to trusted users and networks.
• Enforce least privilege on SharePoint accounts and review who holds site collection administrator or equivalent rights.
• Monitor Microsoft's advisory page for updated guidance and any revision to affected products.
• Keep SharePoint servers isolated from unnecessary outbound and lateral network paths to limit post-exploitation movement.

Detection

• Monitor SharePoint server and IIS logs for unusual or unexpected process creation, especially child processes spawned by w3wp.exe.
• Alert on anomalous web requests to SharePoint endpoints from authenticated accounts, particularly outside normal working patterns.
• Watch for suspicious file writes or new executables in SharePoint web directories and temporary folders.
• Correlate SharePoint authentication events with subsequent command execution or outbound connections from the server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.