CVE-2024-38023: Microsoft SharePoint Server deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a widely deployed server product with a high EPSS score warrants prompt patching, though the required high privileges and lack of KEV listing keep it below critical.

What it is

CVE-2024-38023 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows remote code execution. A successful attack gives the intruder code execution in the SharePoint server context, which matters because SharePoint commonly holds sensitive corporate content and often runs with elevated service privileges. The record is thin: it provides only a one-line description and no affected version list.

Impact

An attacker who can reach the vulnerable endpoint can run arbitrary code on the SharePoint server, potentially leading to full compromise of the host and any data or credentials it can reach.

Attack surface

The CVSS vector is network-reachable (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but it requires high privileges (PR:H), meaning the attacker must already hold an administrative or otherwise highly privileged SharePoint account.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is 0.529 (99th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the Microsoft SharePoint Server security update referenced in the MSRC advisory (CVE-2024-38023) as the first action.
• Restrict and audit highly privileged SharePoint accounts; remove unnecessary site collection administrator and farm administrator rights.
• Limit network exposure of SharePoint servers to trusted internal segments and required clients only.
• Monitor for and block untrusted serialized payloads or unexpected deserialization activity at the SharePoint application layer where feasible.
• Review SharePoint logs for anomalous privileged operations and unexpected process or command execution on the server.

Detection

• Alert on unexpected child processes spawned by SharePoint worker processes (w3wp.exe, SharePoint timer service) on SharePoint hosts.
• Monitor for anomalous deserialization or serialization-related errors and unusual POST requests to SharePoint endpoints from privileged accounts.
• Track creation or modification of highly privileged SharePoint accounts and sudden changes to farm or site collection permissions.
• Correlate SharePoint audit logs with endpoint telemetry for command execution or file writes in web-accessible directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.