March 26, 2024 · Applied Cybernetics Group
CVE-2023-24955 — Microsoft SharePoint Server
known ransomware use
Microsoft SharePoint Server Code Injection Vulnerability
- Added to KEV
2024-03-26- Federal due date
2024-04-16- Vendor
- Microsoft
- Product
- SharePoint Server
- EPSS
- 99.7th percentile (score 0.918, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2023-24955
CISA short description
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.