Actively Exploited SharePoint Flaw Puts On-Premises Servers at Risk

That creates a serious risk because Site Member access is commonly assigned to users who need to collaborate on documents, project sites or departmental content. A stolen password or compromised low-level account could potentially be enough for an attacker to gain control of the SharePoint server.

Once inside, the attacker may attempt to install web shells, establish persistence, access sensitive files, steal information or move laterally into other systems connected to the wider network.

Active Exploitation Raises the Urgency

CISA's decision to add the vulnerability to its Known Exploited Vulnerabilities catalogue means the threat is no longer theoretical.

While public details about the attackers and the exact exploitation techniques remain limited, organisations should assume that externally accessible SharePoint environments are at greater risk. SharePoint servers are often used to store confidential documents, support internal collaboration and connect teams across departments, making them an attractive target for cybercriminals.

A typical attack could begin with an attacker obtaining legitimate credentials, sending a malicious payload to the affected SharePoint server, and then using the resulting code execution to perform further activity inside the organisation.

Affected SharePoint Versions