⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2024-11-12.
CVE-2024-38094 — Deserialization of Untrusted Data in Microsoft Sharepoint Enterprise Server 2016
Severity
7.2HIGHNVD
EPSS
64.3%
top 1.55%
CISA KEV
KEVRansomware
Added 2024-10-22
Due 2024-11-12
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJul 9
KEV addedOct 22
Latest updateNov 6
KEV dueNov 12
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Microsoft SharePoint Remote Code Execution Vulnerability
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9