CVE-2024-38094
published 2024-07-09CVE-2024-38094: Microsoft SharePoint Remote Code Execution Vulnerability
PriorityP186high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
KEVITWRansomware
CISA Known Exploited Vulnerabilitydue 2024-11-12
Exploited in the wild
EPSS
39.10%
98.4th percentile
Microsoft SharePoint Remote Code Execution Vulnerability
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5456.1000 | 16.0.5456.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10412.20001 | 16.0.10412.20001 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.17328.20424 | 16.0.17328.20424 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/web/GetFolderByServerRelativeUrl('/BusinessDataMetadataCatalog')/Files/add(url='...BDCMetadata.bdcm')
url/_vti_bin/client.svc/ProcessQuery
path/BusinessDataMetadataCatalog/BDCMetadata.bdcm
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM File Creation (CVE-2024-38094)"; flow:established,to_server; flowbits:set,ET.Sharepoint.CVE-2024-38094; http.method; content:"POST"; http.uri; content:"|2f|web|2f|GetFolderByServerRelativeUrl|28|"; content:"|2f|BusinessDataMetadataCatalog|2f 27 29 2f|Files|2f|add|28|url|3d|'"; fast_pattern; distance:0; content:"|2f|BusinessDataMetadataCatalog|2f|BDCMetadata|2e|bdcm"; distance:0; http.request_body; content:"Method Name|3d 22|ParseLogFileEntry|22|"; content:"|3c|TypeDescriptor|20|"; content:"|3c|DefaultValue|20|"; reference:cve,2024-38094; classtype:web-application-attack; sid:2057286; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2024_11_06, cve CVE_2024_38094, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_11_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM Execution (CVE-2024-38094)"; flow:established,to_server; flowbits:isset,ET.Sharepoint.CVE-2024-38094; http.method; content:"POST"; http.uri; content:"/_vti_bin/client.svc/ProcessQuery"; fast_pattern; endswith; http.request_body; content:"|22|GetDefaultValues|22|"; content:"|3a|entityfile|3a|"; content:"|3a|notifcallback|3a|"; content:"|3a|lsifile|3a|"; reference:cve,2024-38094; classtype:web-application-attack; sid:2057291; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2024_11_06, cve CVE_2024_38094, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_11_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Stage 1 exploit: Attacker POSTs a malicious .bdcm file to the SharePoint BusinessDataMetadataCatalog folder via GetFolderByServerRelativeUrl. Look for POST requests to URIs matching /web/GetFolderByServerRelativeUrl('/BusinessDataMetadataCatalog')/Files/add containing BDCMetadata.bdcm, with request body containing 'ParseLogFileEntry', TypeDescriptor, and DefaultValue XML elements.
- →Stage 2 exploit: After BDCM file creation (flowbit ET.Sharepoint.CVE-2024-38094 set), attacker POSTs to /_vti_bin/client.svc/ProcessQuery with body containing 'GetDefaultValues', ':entityfile:', ':notifcallback:', and ':lsifile:' to trigger deserialization and RCE.
- →Post-exploitation: Monitor for installation of Huorong Antivirus (HRSword.exe, sysdiag_win10.sys driver, sysdiag service) via batch script 'hrword install.bat', which is used to deliberately conflict with and crash legitimate AV services. ↗
- →Post-exploitation: Monitor for Mimikatz (credential harvesting), FRP (remote access tunneling), Impacket (lateral movement), Certify.exe (ADFS cert abuse), kerbrute (AD ticket brute-force), and everything.exe (network/file enumeration) on SharePoint or domain-joined servers. ↗
- →Attacker compromised a Microsoft Exchange service account with domain administrator privileges after initial SharePoint access — monitor for Exchange service accounts performing domain admin-level actions. ↗
- →Webshell planted on the SharePoint server following initial exploitation — hunt for new/modified files in SharePoint web directories, especially following POST activity to BusinessDataMetadataCatalog endpoints. ↗
- ·Exploitation requires an authenticated attacker with Site Owner permissions on the SharePoint site — unauthenticated exploitation is not possible. ↗
- ·The two Snort/ET rules (SID 2057286 and 2057291) require TLS decryption (tls_state TLSDecrypt / deployment SSLDecrypt) to be effective, as SharePoint traffic is typically HTTPS.
- ·This vulnerability affects on-premise SharePoint Server deployments; the investigated breach involved an on-premise SharePoint server. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vulncheck7.2HIGH
cisa7.2HIGH
vendor_msrc7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft SharePoint Deserialization Vulnerability
cisa·2024-10-22·CVSS 7.2
CVE-2024-38094 [HIGH] CWE-502 Microsoft SharePoint Deserialization Vulnerability
Vulnerability: Microsoft SharePoint Deserialization Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38094
Remediation Due Date: 2024-11-12
Microsoft
Microsoft SharePoint Remote Code Execution Vulnerability
vendor_msrc·2024-07-09·CVSS 7.2
CVE-2024-38094 [HIGH] CWE-502 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?
An authenticated attacker with Site Owner permissions can use the vulnerability to inject arbitrary code and execute this code in the context of SharePoint Server.
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely
Reference: https://www.microsoft.com/download/details.aspx?familyid=92f58fc5-c39d-4a25-bea5-ddee233c734c
Reference: https://support.microsoft.com/help/5002618
Reference: https://www.microsoft.com/download/details.aspx
GHSA
GHSA-whmw-hq6p-c3w4: Microsoft SharePoint Remote Code Execution Vulnerability
ghsa_unreviewed·2024-07-09
CVE-2024-38094 [HIGH] CWE-502 GHSA-whmw-hq6p-c3w4: Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
VulnCheck
Microsoft SharePoint Deserialization Vulnerability
vulncheck·2024·CVSS 7.2
CVE-2024-38094 [HIGH] CWE-502 Microsoft SharePoint Deserialization Vulnerability
Microsoft SharePoint Deserialization Vulnerability
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Affected: Microsoft SharePoint
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://attackerkb.com/topics/Ev24ZWs2iT/cve-2024-38094#exploited-in-the-wild_9c3c0bdd-7a98-48de-a889-f351a2aec7cf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.rapid7.com/blog/post/2024/10/30/investigating-a-sharepoint-compromise-ir-tales-from-the-field/; https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf; https://www.microsoft.com/en-us/secu
Suricata
ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM File Creation (CVE-2024-38094)
suricata·2024-11-06·CVSS 7.2
CVE-2024-38094 [HIGH] ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM File Creation (CVE-2024-38094)
ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM File Creation (CVE-2024-38094)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM File Creation (CVE-2024-38094)"; flow:established,to_server; flowbits:set,ET.Sharepoint.CVE-2024-38094; http.method; content:"POST"; http.uri; content:"|2f|web|2f|GetFolderByServerRelativeUrl|28|"; content:"|2f|BusinessDataMetadataCatalog|2f 27 29 2f|Files|2f|add|28|url|3d|'"; fast_pattern; distance:0; content:"|2f|BusinessDataMetadataCatalog|2f|BDCMetadata|2e|bdcm"; distance:0; http.request_body; content:"Method Name|3d 22|ParseLogFileEntry|22|"; content:"|3c|TypeDescriptor|20|"; content:"|3c|DefaultValue|20|"; reference:cve,2024-38094; classtype:web-application-attack; sid:2057286; rev:1; metadata:affected_product Mi
Suricata
ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM Execution (CVE-2024-38094)
suricata·2024-11-06·CVSS 7.2
CVE-2024-38094 [HIGH] ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM Execution (CVE-2024-38094)
ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM Execution (CVE-2024-38094)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Microsoft Sharepoint BDCM Execution (CVE-2024-38094)"; flow:established,to_server; flowbits:isset,ET.Sharepoint.CVE-2024-38094; http.method; content:"POST"; http.uri; content:"/_vti_bin/client.svc/ProcessQuery"; fast_pattern; endswith; http.request_body; content:"|22|GetDefaultValues|22|"; content:"|3a|entityfile|3a|"; content:"|3a|notifcallback|3a|"; content:"|3a|lsifile|3a|"; reference:cve,2024-38094; classtype:web-application-attack; sid:2057291; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2024_11_06, cve CVE_2024_38094, deployment Perimeter, deployment Internal, deployment SSLDec
No public exploits indexed.
Tenable
CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
blogs_tenable·2026-07-16·CVSS 6.5
CVE-2026-32201 [MEDIUM] CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
## CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments.
## Key Takeaways
CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS machine keys and deploy malware for persistence.
Two additional SharePoint Server vulnerabilities disclosed on July 14, 2026, CVE-2026-55040 and CVE-2026-58644, were not yet
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bleepingcomputer
Microsoft SharePoint RCE bug exploited to breach corporate network
blogs_bleepingcomputer·2024-11-02·CVSS 7.2
CVE-2024-38094 [HIGH] Microsoft SharePoint RCE bug exploited to breach corporate network
## Microsoft SharePoint RCE bug exploited to breach corporate network
## Bill Toulas
A recently disclosed Microsoft SharePoint remote code execution (RCE) vulnerability tracked as CVE-2024-38094 is being exploited to gain initial access to corporate networks.
CVE-2024-38094 is a high-severity (CVSS v3.1 score: 7.2) RCE flaw impacting Microsoft SharePoint, a widely used web-based platform functioning as an intranet, document management, and collaboration tool that can seamlessly integrate with Microsoft 365 apps.
Microsoft fixed the vulnerability on July 9, 2024, as part of the July Patch Tuesday package, marking the issue as "important."
Last week, CISA added CVE-2024-38094 to the Known Exploited Vulnerability Catalog but did not share how the flaw was exploited in attacks.
A new rep
Talos
Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
blogs_talos·2024-07-09·CVSS 7.2
[HIGH] Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
## Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 142 vulnerabilities across its suite of products and software. Of those, there are five critical vulnerabilities, and every other security issue disclosed this month is considered "important."
This is the largest Patch Tuesday since April when Microsoft patched 150 vulnerabilities.
Of the critical vulnerabilities, two are considered more likely to be exploited:
CVE-2024-38023 , a remote code execution vulnerability in Microsoft SharePoint server, where an authenticated attacker with Site Owner permissions can use the vulnerability to execute arbitrary code in the context of SharePoint server.
CVE-2024-38060 , a remote code execution vulnerabili
Trendmicro
The July 2024 Security Update Review
blogs_trendmicro·2024-07-09
The July 2024 Security Update Review
## The July 2024 Security Update Review
Get the July 2024 security update and review.
By: Dustin Childs 2024/07/09 Read time: ( words)
Save to Folio
We’re just past the halfway point of 2024, and as expected, Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for July 2024
For July, Adobe released three patches addressing seven CVEs in Adobe Premiere Pro, InDesign, and Adobe Bridge. The patch for InDesign is the largest, fixing four Critical-rated CVEs. All four could lead to arbitrary code execution. The fix for Premiere Pro fixes a single CVE
Talos
Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
blogs_talos·2024-07-09·CVSS 7.2
CVE-2024-38023 [HIGH] Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 142 vulnerabilities across its suite of products and software. Of those, there are five critical vulnerabilities, and every other security issue disclosed this month is considered "important."
This is the largest Patch Tuesday since April when Microsoft patched 150 vulnerabilities.
Of the critical vulnerabilities, two are considered more likely to be exploited:
CVE-2024-38023, a remote code execution vulnerability in Microsoft SharePoint server, where an authenticated attacker with Site Owner permissions can use the vulnerability to execute arbitrary code in the context of SharePoint server.
CVE-2024-38060, a remote code execution vulnerability in Microsoft Windows Codecs Library that can be exploited by an authentic
Qualys
Microsoft and Adobe Patch Tuesday, July 2024 Security Update Review
blogs_qualys·2024-07-09
Microsoft and Adobe Patch Tuesday, July 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for July 2024
Adobe Patches for July 2024
Zero-day Vulnerabilities Patched in July Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in July Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
July’s Patch Tuesday brings a midsummer wave of updates, addressing critical vulnerabilities and enhancing security across the Microsoft ecosystem. Let’s discover the highlights from Microsoft’s Patch Tuesday updates for July 2024.
## Microsoft Patch Tuesday for July
Trendmicro
The July 2024 Security Update Review
blogs_trendmicro·2024-07-09
The July 2024 Security Update Review
# The July 2024 Security Update Review
Get the July 2024 security update and review.
By: Dustin Childs
2024/07/09
Read time: ( words)
Save to Folio
We’re just past the halfway point of 2024, and as expected, Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for July 2024
For July, Adobe released three patches addressing seven CVEs in Adobe Premiere Pro, InDesign, and Adobe Bridge. The patch for InDesign is the largest, fixing four Critical-rated CVEs. All four could lead to arbitrary code execution. The fix for Premiere Pro fixes a single CVE
Qualys
Microsoft and Adobe July 2024 Security Patches Explained | Qualys
blogs_qualys·2024-07-09
Microsoft and Adobe July 2024 Security Patches Explained | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for July 2024
- Adobe Patches for July 2024
- Zero-day Vulnerabilities Patched in July Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in July Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
July’s Patch Tuesday brings a midsummer wave of updates, addressing critical vulnerabilities and enhancing security across the Microsoft ecosystem. Let’s discover the highlights from Microsoft’s Patch Tuesday updates for July 2024.
## Microsoft Patch Tue
2024-07-09
Published
2024-10-22
Added to CISA KEV
Exploited in the wild