CVE-2024-38094

Think of SharePoint like your company’s office building where documents and collaboration happen. This vulnerability is like a door that—if it’s reachable and left unpatched—can let an attacker break in and run commands inside the building using your SharePoint system.
Because it has been used in real ransomware campaigns, it’s not just a theoretical risk.

This matters if your business runs Microsoft SharePoint server software (SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) and that SharePoint instance is exposed or reachable in a way attackers can access the vulnerable functionality.
It is only a risk when the attacker can reach the target SharePoint server and use the vulnerable path (there’s no indication you can be protected just by “not clicking” on anything).

This is RED because the vulnerability is confirmed in the CISA Known Exploited Vulnerabilities catalog and has been used in ransomware campaigns.
Attackers already have weaponized tooling, so delaying patching increases your chance of becoming an active target.

Confirm whether you’re exposed

1. Identify your SharePoint edition:
   • Microsoft SharePoint Enterprise Server 2016
   • Microsoft SharePoint Server 2019
   • Microsoft SharePoint Server Subscription Edition
2. Check your current SharePoint build/version.
3. Compare your build to the fixed versions Microsoft provided for CVE-2024-38094 (below). If your build is older than the fixed version for your edition, you should assume you are vulnerable.

Upgrade to the fixed version (target)

• SharePoint Enterprise Server 2016: fixed in 16.0.5456.1000
• SharePoint Server 2019: fixed in 16.0.10412.20001
• SharePoint Server Subscription Edition: fixed in 16.0.17328.20424

Use Microsoft’s update guidance for CVE-2024-38094:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094

If patching is delayed (mitigation path)

• Follow Microsoft’s “Apply mitigations per vendor instructions” guidance from the CISA KEV listing for this CVE.
• Reduce exposure while mitigating:
  • Ensure unnecessary internet exposure is removed (for example, limit inbound access paths to only what’s required).
  • Confirm network controls are in place so attackers cannot reach the SharePoint server outside intended routes.

After patching

1. Verify SharePoint services and the web front end are healthy after the update.
2. Confirm the installed update level matches the fixed build for your edition.
3. Monitor logs for unexpected access patterns and follow up on any suspicious requests around the web-facing SharePoint endpoints.

Timing

• CISA KEV remediation due date for this CVE: 2024-11-12.

CVE-2024-38094 is a Microsoft SharePoint remote code execution vulnerability associated with CWE-502. It is listed in CISA’s KEV and has been used in ransomware campaigns, which makes real-world exploitation a confirmed concern.

Findings indicate:

• Exploit availability: a public exploit exists.
• Exploitation status: confirmed real-world exploitation via CISA KEV.
• Fixed builds are provided by Microsoft for SharePoint Server 2016, 2019, and Subscription Edition.

KEV meaning here: once a vulnerability is added to KEV with a remediation date, defenders are expected to apply the vendor fixes or approved mitigations because it’s actively abused.

Attackers can leverage a network-reachable path to trigger execution leading to full compromise of the SharePoint host process context, which is why the impact includes service disruption and data compromise in addition to ransomware risk.