CVE-2021-28474
published 2021-05-11CVE-2021-28474: Microsoft SharePoint Server Remote Code Execution Vulnerability
PriorityP270high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
50.63%
98.8th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5161.1000 | 16.0.5161.1000 |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < 15.0.5345.1000 | 15.0.5345.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10374.20000 | 16.0.10374.20000 |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandysoserial.exe -p ViewState -g TypeConfuseDelegate -c "echo RCE > c:/windows/temp/SP_RCE_01.txt" --generator="AF878507" --validationkey="FAB45BC67E06323C48951DA2AEAF077D8786291E2748330F03B6601F09523B79" --validationalg="HMACSHA256" --islegacy --minify↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint WebPartPages Authenticated Remote Code Execution (CVE-2021-28474)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/_vti_bin/WebPartPages.asmx"; fast_pattern; http.request_body; pcre:"/[rR][uU][nN][aA][tT](?:\x3d|\x253[dD]|\x26equals\x3b)(?:\x22|\x2522|\x26quot\x3b)server(?:\x22|\x2522|\x26quot\x3b)/"; content:"OuterHtml|3d|"; content:"|2f|web.config"; distance:0; reference:url,www.zerodayinitiative.com/blog/2021/7/7/cve-2021-28474-sharepoint-remote-code-execution-via-server-side-control-interpretation-conflict; reference:cve,2021-28474; classtype:web-application-attack; sid:2063645; rev:2; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_21, cve CVE_2021_28474, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Monitor for HTTP POST requests to /_vti_bin/WebPartPages.asmx containing 'OuterHtml' in the body alongside references to 'web.config', which indicates exploitation of the ExecuteProxyUpdates method to exfiltrate the machineKey.
- →Detect HTML-encoded variants of runat="server" (e.g., runat="server" or runat=%22server%22) in ASPX markup submitted to SharePoint, as the bypass relies on HTML-encoding the attribute value to evade VerifyControlOnSafeList while still being executed at processing time. ↗
- →Alert on POST requests to /ToolPane.aspx with DisplayMode=Edit parameter and HTTP Referer set to /SignOut.aspx, as this URL pattern and referer combination is a key indicator of CVE-2025-53770 exploitation (which chains from CVE-2021-28474 mechanics). ↗
- →Hunt for ysoserial.exe invocations with '-p ViewState -g TypeConfuseDelegate' arguments on hosts that have access to SharePoint servers, as this is the tool and gadget chain used to forge malicious ViewState payloads for RCE. ↗
- →Monitor for the creation of unexpected .txt or .aspx files in C:\windows\temp\ or C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\ by the SharePoint service account process, as these paths are used as RCE proof-of-execution drop locations. ↗
- →Flag requests containing the __VIEWSTATE parameter in the query string sent to SharePoint pages (rather than in the POST body), as the exploit delivers the forged ViewState payload via URL query string. ↗
- ·Exploitation requires the attacker to be authenticated and hold SPBasePermissions.ManageLists on a SharePoint site. By default, any authenticated user can create a site and obtain these permissions, so the effective attack surface is all authenticated users. ↗
- ·The validationKey value (FAB45BC67E06323C48951DA2AEAF077D8786291E2748330F03B6601F09523B79) is from a specific PoC lab environment and is not a universal indicator; each SharePoint deployment has a unique machineKey. Detection should focus on the exfiltration attempt (web.config read via System.Web.UI.WebControls.Xml) rather than this specific key value. ↗
- ·The Snort rule (sid:2063645) was created on 2025-07-21 and requires TLS decryption (tls_state TLSDecrypt) to be effective against HTTPS SharePoint deployments.
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2021-05-11·CVSS 8.8
CVE-2021-28474 [HIGH] Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
In a network-based attack, an authenticated attacker can gain access to create a site and could execute code remotely within the SharePoint Server.
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=650bb002-b472-4d9b-b36e-d960150b2ab7
Reference: https://www.microsoft.com/download/details.aspx?familyid=0036da36-a42a-47e3-855d-9485daf73539
Reference: https://www.microsoft.com/download/detai
GHSA
GHSA-f4c7-7cmx-q7fx: Microsoft SharePoint Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-28474 [HIGH] CWE-436 GHSA-f4c7-7cmx-q7fx: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Suricata
ET WEB_SPECIFIC_APPS Microsoft Sharepoint WebPartPages Authenticated Remote Code Execution (CVE-2021-28474)
suricata·2025-07-21·CVSS 8.8
CVE-2021-28474 [HIGH] ET WEB_SPECIFIC_APPS Microsoft Sharepoint WebPartPages Authenticated Remote Code Execution (CVE-2021-28474)
ET WEB_SPECIFIC_APPS Microsoft Sharepoint WebPartPages Authenticated Remote Code Execution (CVE-2021-28474)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint WebPartPages Authenticated Remote Code Execution (CVE-2021-28474)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/_vti_bin/WebPartPages.asmx"; fast_pattern; http.request_body; pcre:"/[rR][uU][nN][aA][tT](?:\x3d|\x253[dD]|\x26equals\x3b)(?:\x22|\x2522|\x26quot\x3b)server(?:\x22|\x2522|\x26quot\x3b)/"; content:"OuterHtml|3d|"; content:"|2f|web.config"; distance:0; reference:url,www.zerodayinitiative.com/blog/2021/7/7/cve-2021-28474-sharepoint-remote-code-execution-via-server-side-control-interpretation-conflict; reference:cve,2021-28474; classtype:web-application-at
No public exploits indexed.
Zscaler
CVE-2025-53770 | ThreatLabz
blogs_zscaler·2025-07-21·CVSS 9.8
[CRITICAL] CVE-2025-53770 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Trendmicro
SharePoint Remote Code Execution Interpretation Conflict
blogs_trendmicro·2021-07-08·CVSS 8.8
CVE-2021-28474 [HIGH] SharePoint Remote Code Execution Interpretation Conflict
# CVE-2021-28474: SharePoint Remote Code Execution via Server-Side Control Interpretation Conflict
Learn about the SharePoint remote code execution interpretation causes a conflict.
By: Zero Day Initiative
2021/07/08
Read time: ( words)
Save to Folio
In May of 2021, Microsoft released a patch to correct CVE-2021-28474, a remote code execution bug in supported versions of Microsoft SharePoint Server. This bug was reported to ZDI by an anonymous researcher and is also known as ZDI-21-574. This blog takes a deeper look at the root cause of this vulnerability.
The vulnerability allows authenticated users to execute arbitrary .NET code on the server in the context of the service account of the SharePoint web application. For a successful attack, the attacker needs SPBasePermissions.Manage
Trendmicro
SharePoint Remote Code Execution Interpretation Conflict
blogs_trendmicro·2021-07-08·CVSS 8.8
CVE-2021-28474 [HIGH] SharePoint Remote Code Execution Interpretation Conflict
## CVE-2021-28474: SharePoint Remote Code Execution via Server-Side Control Interpretation Conflict
Learn about the SharePoint remote code execution interpretation causes a conflict.
By: Zero Day Initiative 2021/07/08 Read time: ( words)
Save to Folio
In May of 2021, Microsoft released a patch to correct CVE-2021-28474 , a remote code execution bug in supported versions of Microsoft SharePoint Server. This bug was reported to ZDI by an anonymous researcher and is also known as ZDI-21-574 . This blog takes a deeper look at the root cause of this vulnerability.
The vulnerability allows authenticated users to execute arbitrary .NET code on the server in the context of the service account of the SharePoint web application. For a successful attack, the attacker needs SPBasePermissions.Mana
Trendmicro
SharePoint Remote Code Execution Interpretation Conflict
blogs_trendmicro·2021-07-08·CVSS 8.8
CVE-2021-28474 [HIGH] SharePoint Remote Code Execution Interpretation Conflict
## CVE-2021-28474: SharePoint Remote Code Execution via Server-Side Control Interpretation Conflict
Learn about the SharePoint remote code execution interpretation causes a conflict.
By: Zero Day Initiative Jul 08, 2021 Read time: ( words)
Save to Folio
In May of 2021, Microsoft released a patch to correct CVE-2021-28474 , a remote code execution bug in supported versions of Microsoft SharePoint Server. This bug was reported to ZDI by an anonymous researcher and is also known as ZDI-21-574 . This blog takes a deeper look at the root cause of this vulnerability.
The vulnerability allows authenticated users to execute arbitrary .NET code on the server in the context of the service account of the SharePoint web application. For a successful attack, the attacker needs SPBasePermissions.Ma
Tenable
Microsoft’s May 2021 Patch Tuesday Addresses 55 CVEs (CVE-2021-31166)
blogs_tenable·2021-05-11·CVSS 9.8
[CRITICAL] Microsoft’s May 2021 Patch Tuesday Addresses 55 CVEs (CVE-2021-31166)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft & Adobe Patch Tuesday (May 2021) – Qualys covers 85 Vulnerabilities, 26 Critical
blogs_qualys·2021-05-11·CVSS 9.9
CVE-2021-31181 [CRITICAL] Microsoft & Adobe Patch Tuesday (May 2021) – Qualys covers 85 Vulnerabilities, 26 Critical
## Microsoft Patch Tuesday – May 2021
Microsoft patched 55 CVEs in their May 2021 Patch Tuesday release, of which 4 are rated as critical severity. Three 0-day vulnerability patches were included in the release. As of this publication date, none have been exploited.
Qualys released 12 QIDs on the same day, providing vulnerability detection and patch management coverage (where applicable) for all 55 CVEs and the related KBs.
## Critical Microsoft vulnerabilities patched:
CVE-2021-31181 – SharePoint Remote Code Execution Vulnerability
Microsoft released patches addressing a critical RCE vulnerability in SharePoint (CVE-2021-31181). This CVE has a high likelihood of exploitability and is assigned a CVSSv3 base score of 8.8 by the vendor.
CVE-2021-31166 – HTTP Protocol Stack Remote Code
Crowdstrike
May 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] May 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
May 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] May 2021 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2021-05-11
Published