Microsoft SharePoint Server Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in on-premises Microsoft SharePoint Server. This issue arises from the deserialization of untrusted data, allowing an unauthorized attacker to execute code over the network. The vulnerability affects multiple SharePoint Server versions, including the Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected SharePoint Server.

Remediation

Customers can enable the AMSI integration feature and use Microsoft Defender across their SharePoint Server farms for protection. If AMSI integration is not an option, it is recommended to remove internet access from the SharePoint server. Microsoft is also preparing a comprehensive update to address this vulnerability, which will be announced when available.