CVE-2023-24955: Microsoft SharePoint Server code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution, is confirmed exploited in the wild per CISA KEV, and is associated with known ransomware campaign use, making it an urgent patch target despite the high-privilege requirement.

What it is

CVE-2023-24955 is a code injection flaw (CWE-94) in Microsoft SharePoint Server and SharePoint Enterprise Server that allows remote code execution. It matters because the flaw is confirmed exploited in the wild, listed in CISA's KEV catalog, and tied to known ransomware campaign use, so unpatched SharePoint deployments are an active target.

Impact

An attacker who can reach the vulnerable code path gains remote code execution on the SharePoint server, with high impact to confidentiality, integrity and availability. In practice this means server compromise and a foothold for follow-on activity such as ransomware deployment.

Attack surface

The vector is network-reachable (AV:N) with no user interaction (UI:N), but it requires high privileges (PR:H), so an attacker needs an authenticated account with elevated rights on the SharePoint instance. It is not a pre-auth, unauthenticated attack based on the supplied vector.

Exploitation

Exploitation is confirmed: the CVE is in CISA's KEV catalog (added 2024-03-26, due 2024-04-16) with known ransomware campaign use, and EPSS gives a 30-day probability of 0.854 at the 99.7th percentile. The references include vendor patch advisories and the CISA KEV entry, but no public exploit write-up is cited in the record.

What to do

• Apply the Microsoft SharePoint security update referenced in the MSRC advisory for CVE-2023-24955 as the first action.
• If patching cannot be completed immediately, follow CISA's required action and apply vendor mitigations or discontinue use of the affected product.
• Restrict and audit high-privilege SharePoint accounts, since exploitation requires high privileges (PR:H).
• Limit network exposure of SharePoint servers to trusted networks and required users only.
• Monitor for and remove unauthorized web parts, pages or code changes on SharePoint servers.

Detection

• Hunt for unexpected w3wp.exe or SharePoint worker process spawning of cmd.exe, powershell.exe or other shells.
• Review SharePoint logs for anomalous authenticated activity from high-privilege accounts, especially code or page modifications.
• Monitor for new or modified files under SharePoint web directories and the layout directory.
• Alert on outbound connections from SharePoint servers to unfamiliar hosts, which may indicate post-exploitation or ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.