Horizon Alert
Summary of the vulnerability and why it matters
On-premises Microsoft SharePoint Server is vulnerable to an issue that allows unauthorized attackers to execute code remotely. This flaw stems from the server's handling of untrusted data, potentially impacting the confidentiality, integrity, and availability of systems and data. The business risk associated with this vulnerability is significant, as it can lead to a compromise of the entire server.
- Vulnerable SharePoint Server
- Untrusted data deserialization
- Remote code execution impact
Attack Path
How an attacker could exploit the issue
A deserialization vulnerability in on-premises SharePoint Server allows an attacker to execute code remotely. An attacker can exploit this by sending specially crafted data to an exposed SharePoint server. This could lead to unauthorized code execution and compromise of affected systems.
- Unauthenticated network access
- Attacker sends malicious data
- Remote code execution achieved
Live Threat
Current exploitation, exposure, and threat context
Microsoft SharePoint Server is experiencing active exploitation of a critical vulnerability that allows unauthorized attackers to execute code remotely. Exploitation is occurring over a network without requiring prior access or authentication. Given that an exploit is in the wild and Microsoft is aware of its use, organizations should consider this a high-priority threat.
- Attacker skill: Low
- Access needed: None
- Business risk: Urgent
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for this vulnerability exists in the wild and is actively preparing a comprehensive update. Organizations should take immediate steps to identify and protect exposed assets.
- Find exposed SharePoint assets.
- Implement provided mitigations.
- Apply vendor fix and verify.
- Monitor for related activity.
