CVE-2023-29357: Microsoft SharePoint Server elevation of privilege via authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, and near-maximum EPSS make this an urgent patch-first issue.

What it is

CVE-2023-29357 is a critical elevation of privilege flaw in Microsoft SharePoint Server. The CVSS vector shows it is network reachable with no privileges or user interaction required, and the CWE mapping points to improper authentication or authorization logic. Because it is in CISA KEV with known ransomware use, it is a high-value target for defenders.

Impact

An unauthenticated attacker can gain elevated privileges on the SharePoint server, potentially taking over the application and its data. In ransomware chains this access is used to move laterally and stage further compromise.

Attack surface

Reachable over the network via the SharePoint web interface; the CVSS vector indicates no authentication and no user interaction are required. Any internet- or intranet-exposed SharePoint instance is in scope.

Exploitation

CISA added it to KEV on 2024-01-10 with a due date of 2024-01-31 and flags known ransomware campaign use. EPSS is 0.99984 (99.98th percentile), and the vendor advisory is tagged Patch, indicating active exploitation pressure.

What to do

• Apply the Microsoft security update for CVE-2023-29357 immediately; this is the primary fix.
• If patching cannot be completed, follow CISA guidance to apply vendor mitigations or discontinue use of the product.
• Restrict network access to SharePoint servers to trusted networks and block unnecessary internet exposure.
• Enable and review SharePoint audit logging and authentication logs for anomalous privileged activity.
• Verify no unauthorized administrative accounts or web shells were created before patching.

Detection

• Monitor SharePoint ULS and IIS logs for authentication bypass patterns or unexpected privileged requests from unauthenticated sessions.
• Alert on creation of new site collection administrators or elevated SharePoint roles outside change windows.
• Hunt for web shell files or unexpected ASPX modifications in SharePoint layouts and bin directories.
• Correlate SharePoint access with subsequent lateral movement or ransomware precursor activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.