CVE-2024-38094Active Exploitation(microsoft / sharepoint_server)

MEDIUMCVSS 7.2 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft sharepoint_server systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Microsoft SharePoint Remote Code Execution Vulnerability

microsoft CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-11-12. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Patch / fix

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38094

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sharepoint_server

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-08-27); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

sharepoint_server

3 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Active Exploitation

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc19d
Active Exploitation
TRC analysis shows Microsoft initially misclassified CVE-2024-38094 as a spoofing vulnerability (CVSS 6.5) when it actually enables authenticated remote code execution (CVSS 8.8). Attackers bypass SafeControls validation to deploy in-memory webshells in SharePoint environments. This misclassification may have led organizations to deprioritize critical patches. #CloudSecurity #Vulnerability 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/sharepoint-cve-2026-65660-rce-vulnerability-microsoft-classification-error
Post summary
Microsoft misclassified CVE-2024-38094 as spoofing (CVSS 6.5) when it is actually authenticated RCE (CVSS 8.8); attackers are actively exploiting it via SafeControls bypass to deploy webshells in SharePoint, and organizations deprioritized patching due to the misclassification.
0000034
2.0K followersView on X
Aviatrix Threat Research Center@aviatrixtrc46d
Active Exploitation
TRC analysis shows attackers chaining CVE-2024-38094 and CVE-2024-38093 to bypass SharePoint JWT authentication and achieve remote code execution. Over 8,700 exposed instances face immediate risk as exploit chains enable lateral movement across SharePoint farms. Runtime segmentation helps limit blast radius in post-compromise scenarios. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/microsoft-sharepoint-rce-chain-cve-2026-55040-63520-exploit
Post summary
The analysis confirms that attackers are actively chaining CVE-2024-38094 and CVE-2024-38093 to bypass SharePoint authentication and achieve remote code execution across more than 8,700 exposed instances.
0000046
1.9K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	sharepoint_server	-	-	-
App	microsoft	sharepoint_server	2016	-	-
App	microsoft	sharepoint_server	2019	-	-

Explore more

Back to dashboard microsoft CVEs sharepoint_server vulnerabilities