CVE-2021-27076

This vulnerability lets an attacker send network requests to your SharePoint server and make it run code of the attacker’s choosing—without needing to log in. Think of it like a lock that doesn’t require a key: if the front door is reachable from the outside, the attacker may be able to get in and do what they want on the server. In real attacks, malicious code has been delivered and run through this type of weakness.

This matters if you run Microsoft SharePoint Server (including SharePoint Foundation and Enterprise Server versions listed in the findings) and it’s reachable over a network connection. It’s especially important if your SharePoint is internet-facing or otherwise accessible from outside your organization.

This is only a risk if an attacker can reach the vulnerable SharePoint server over the network—no login or user action is required for the attack attempt.

This is urgent because real-world exploitation has been reported, with malware deployment via the SharePoint-facing attack path. Even though it’s not listed in CISA’s KEV set (in the findings), the reported use in attacks means you should treat this as a serious, patch-priority item.

Verdict: AMBER—act promptly, prioritizing exposure reduction and patching for any internet-reachable SharePoint servers.