CVE-2024-38018: Microsoft SharePoint Server deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges and no user interaction, combined with a 98.9th percentile EPSS score, makes this a high-priority patch despite the absence of KEV listing or public exploit detail.

What it is

CVE-2024-38018 is a remote code execution flaw in Microsoft SharePoint Server, classified by NVD under CWE-502 (deserialization of untrusted data) with a secondary 'no information' CWE. The record gives only a one-line description and no root-cause detail, but the CVSS vector shows a network-reachable bug that a low-privileged user can trigger without user interaction, and it carries a high EPSS score, so it deserves prompt attention.

Impact

A successful attacker executes arbitrary code on the SharePoint server, gaining the privileges of the affected process and potentially full control of the host and its data. Because the vector rates confidentiality, integrity and availability all High, the blast radius extends to hosted content and any credentials or sessions the server holds.

Attack surface

Reached over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated low-privileged SharePoint user is a candidate entry point. The record does not specify the exact endpoint or feature involved.

Exploitation

CISA KEV does not list this CVE and no ransomware usage is documented, but EPSS is 0.51461 (98.9th percentile), indicating a high modeled likelihood of exploitation. The only reference is Microsoft's patch advisory, so there is no public exploit or in-the-wild confirmation in this record.

What to do

• Apply the Microsoft SharePoint Server security update from the MSRC advisory for CVE-2024-38018 as the first action.
• If patching cannot be immediate, restrict network access to SharePoint endpoints to trusted users and networks and reduce the number of accounts with site access.
• Review and minimize permissions for low-privileged SharePoint users, since the flaw requires only PR:L.
• Monitor Microsoft guidance and any follow-up advisories for interim workarounds specific to this vulnerability.

Detection

• Monitor SharePoint server processes (for example w3wp.exe) for unexpected child processes or command execution, which would indicate post-exploitation code execution.
• Alert on anomalous or unexpected deserialization-related activity and unusual requests to SharePoint web endpoints from low-privileged accounts.
• Correlate SharePoint application and IIS logs for suspicious POST requests or serialized payload patterns around the time of any process creation events.
• Track authentication and access patterns for low-privileged SharePoint users that deviate from their normal baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.