CVE-2021-27076

This vulnerability lets an attacker send network requests to your SharePoint server and make it run code of the attacker’s choosing—without needing to log in. Think of it like a lock that doesn’t require a key: if the front door is reachable from the outside, the attacker may be able to get in and do what they want on the server. In real attacks, malicious code has been delivered and run through this type of weakness.

This matters if you run Microsoft SharePoint Server (including SharePoint Foundation and Enterprise Server versions listed in the findings) and it’s reachable over a network connection. It’s especially important if your SharePoint is internet-facing or otherwise accessible from outside your organization.

This is only a risk if an attacker can reach the vulnerable SharePoint server over the network—no login or user action is required for the attack attempt.

This is urgent because real-world exploitation has been reported, with malware deployment via the SharePoint-facing attack path. Even though it’s not listed in CISA’s KEV set (in the findings), the reported use in attacks means you should treat this as a serious, patch-priority item.

Verdict: AMBER—act promptly, prioritizing exposure reduction and patching for any internet-reachable SharePoint servers.

1. Confirm exposure (fast check)

• Determine whether SharePoint is reachable from outside your network (internet-facing URLs, reverse proxies, load balancers, or VPN-accessible endpoints).
• If you have a security scanner or WAF logs, check for requests reaching SharePoint endpoints from untrusted IPs.

2. Confirm whether you’re running an affected product

• Check your installed SharePoint product type:
  • Microsoft SharePoint Foundation
  • Microsoft SharePoint Enterprise Server 2016
  • Microsoft SharePoint Server 2019
  • Microsoft Business Productivity Servers
  • Microsoft Business Productivity Servers 2010 Service Pack 2
  • Microsoft SharePoint Foundation 2013 Service Pack 1
• Confirm the installed service pack level (where applicable) because patching depends on which branch your server is on.

3. Patch to the Microsoft-published fixed update for CVE-2021-27076

• The findings indicate that fixed versions are available for the listed SharePoint products, but they do not provide exact “fixed version numbers.”
• Use Microsoft’s update guidance/advisory for CVE-2021-27076 to select and install the correct update for your branch:
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27076
  • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076

4. Verify the patch

• After installing updates, verify the servers are on the patched build using your normal patch verification approach (Windows Update history and/or SharePoint/server build verification methods used in your environment).
• Confirm SharePoint services still function normally.

5. Temporary workaround if patching is delayed

• Limit network reachability: ensure SharePoint is not directly reachable from the public internet.
• Restrict inbound access to trusted networks only (e.g., office IP ranges, VPN, or internal-only routing), and block all other inbound traffic to SharePoint endpoints until patched.

6. What to monitor after remediation

• Monitor authentication logs and web/app logs for suspicious requests to SharePoint endpoints.
• If you have endpoint detection, check the SharePoint servers for signs of malware deployment consistent with remote code execution activity (for example, unusual processes spawned from web/application service contexts).

CISA due date

• Not available from the provided findings (and KEV is not listed in CISA KEV here).

Severity and exposure: The reported impact is Remote Code Execution over the network, without authentication or user interaction, allowing arbitrary code execution on Microsoft SharePoint Server. The traffic-light verdict is AMBER based on exploitation being reported in the findings.

Exploitation status: Real-world exploitation has been reported (SharkLoader malware deployed in the StrikeShark campaign), and the activity targeted internet-facing applications including Microsoft Exchange (with CVE-2021-27076 called out in the findings as part of that exploitation activity). No public exploit code was found in the provided findings, which does not contradict observed exploitation.

Weakness/Details: The findings list the capability as Remote Code Execution with network attack vector and no required authentication. The weakness is listed as “NVD-CWE-noinfo,” meaning the specific CWE category was not provided in the findings.

KEV/EPSS: CVE-2021-27076 is not listed in CISA KEV in the provided findings. EPSS was provided as a prediction (9.2%, flat trend), but exploitation reporting in the findings is treated as the stronger signal and the public EPSS value is not used to drive urgency language.

Fixed versions: The findings state that fixes are available for multiple SharePoint branches (SharePoint Enterprise Server 2016, SharePoint Server 2019, Microsoft Business Productivity Servers 2010 Service Pack 2, and SharePoint Foundation 2013 Service Pack 1), and direct Microsoft remediation links are provided.