CVE-2022-44690: Microsoft SharePoint Server remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges and no user interaction, plus a very high EPSS score, make this a serious risk despite the lack of confirmed exploitation.

What it is

CVE-2022-44690 is a remote code execution vulnerability in Microsoft SharePoint Foundation and SharePoint Server. The record gives only a one-line description and no root-cause detail, so the exact flaw mechanism is unknown, but the CVSS vector shows a network-reachable issue that a low-privileged user can trigger without user interaction. It matters because successful exploitation yields full compromise of confidentiality, integrity and availability on the SharePoint host.

Impact

An attacker with a low-privileged account can execute arbitrary code on the SharePoint server, gaining control of the application and potentially the underlying host. This can lead to data theft, tampering, or use of the server as a foothold for lateral movement.

Attack surface

Reached over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated low-privileged SharePoint user can attempt it. No details on the specific endpoint or component are provided in the record.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.821 (99.6th percentile), indicating strong predicted exploitation activity. The two references are both Microsoft update-guide links with no exploit tags, so no confirmed in-the-wild exploitation is stated.

What to do

• Apply the Microsoft security update for CVE-2022-44690 as soon as possible.
• Restrict SharePoint access to trusted users and remove unnecessary low-privileged accounts.
• Enable and monitor SharePoint audit logging for suspicious server-side activity.
• Segment the SharePoint server from other critical systems to limit lateral movement.
• Review and harden SharePoint service account permissions.

Detection

• Monitor SharePoint server logs for unexpected process creation or child processes spawned by SharePoint worker processes.
• Alert on anomalous web requests to SharePoint endpoints from low-privileged accounts.
• Watch for unusual file writes or new files in SharePoint web directories.
• Correlate SharePoint audit events with network connections to unfamiliar external hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.