CISA’s required action for CVE-2023-24955 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Microsoft SharePoint Server in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.
What makes CVE-2023-24955 urgent to handle now?
Because Microsoft sharepoint server code injection is an actively exploited weakness, the practical question is not only whether the update exists, but whether every exposed SharePoint instance can be brought under vendor mitigation quickly. For this class of issue, the correct response is asset discovery first, then either patching or removing exposure if the vendor path cannot be applied.
The immediate decision point is whether the server is internet-facing or reachable from broadly trusted internal segments. If it is, exposure reduction becomes part of the fix, not a separate hardening task. Treat any delayed remediation as a short-lived exception that needs compensating control and explicit ownership.
How do you patch or mitigate it safely?
Start by locating every Microsoft SharePoint Server deployment, including forgotten test systems, delegated admin instances, and environments that may not be in your normal patch cadence. Then apply the vendor security update or the documented mitigation exactly as directed by Microsoft, rather than trying to improvise a partial workaround. For vulnerability triage and prioritisation, use CISA Known Exploited Vulnerabilities Catalog alongside the vendor advisory.
If the required mitigation cannot be applied cleanly, the safer choice is to remove internet exposure or discontinue use of the product until a supported fix is in place. This matters because code injection is not a cosmetic flaw: once the flaw is reachable, the security boundary is the server itself, not the web application front end.
For version and product confirmation, keep your verification tied to authoritative records such as the CVE Program and the NIST National Vulnerability Database, then follow the SharePoint vendor guidance for the exact remediation steps.
What should you check after remediation?
After patching or mitigation, validate that the instance is no longer exposed to the original attack path and that no signs of earlier compromise remain. For SharePoint, that means reviewing web server and application logs, checking for unexpected file changes, suspicious administrative actions, new user creation, unusual outbound traffic, and any evidence of post-exploitation persistence. If the server handled sensitive content or had high privilege connections, widen the review to adjacent systems it could reach.
When patching is delayed, assume the window of exposure may already have been used. The practical response is to hunt for compromise first, then restore normal exposure only when you can explain why the system is no longer a viable target. This is especially important when the service is reachable from the internet or from a partner network.
Risk and Threat Considerations
Code injection on a collaboration platform can turn a content server into an execution foothold, which creates immediate risk to data, authentication material, and connected internal services. The main threat is not just application abuse, but follow-on access after the initial code execution path is obtained.
Failure mechanism: An attacker reaches the vulnerable SharePoint endpoint, injects code, and uses that execution context to read data, plant persistence, or move toward adjacent systems that trust the server.
Impact: The result can include data theft, web shell placement, lateral movement, and a longer dwell time if the server is left exposed while remediation is pending.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | SharePoint remediation starts with finding every exposed instance. |
| PR.IP-12 — Vulnerability management plan is implemented | The question is about applying mitigation or patching for an exploited CVE. | |
| DE.CM-08 — Vulnerability scans are performed | Post-remediation validation should confirm the vulnerable exposure is no longer present. | |
| Recommendation — Inventory every SharePoint server and track remediation status centrally. Apply the vendor fix or documented mitigation under your vulnerability management process. Verify the affected SharePoint exposure has been removed and rescan for residual risk. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires identifying exposure and tracking remediation completion. |
| SI-2 — Flaw Remediation | The core action is to apply the vendor update or mitigation for a known flaw. | |
| AC-3 — Access Enforcement | Removing internet exposure or service availability is an access-control decision under mitigation. | |
| Recommendation — Scan for vulnerable SharePoint instances and verify remediation closure. Remediate the SharePoint flaw with the vendor update or approved mitigation. Restrict access or remove exposure when remediation cannot be completed safely. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The response depends on prioritising and remediating an actively exploited CVE. |
| CIS-12 — Network Infrastructure Management | Exposure reduction by removing internet access is part of the mitigation path. | |
| Recommendation — Prioritise and remediate exposed SharePoint servers under continuous vulnerability management. Remove unnecessary external exposure for vulnerable SharePoint servers. | ||
Practitioner Guidance
What to prioritise: Treat exposed SharePoint servers as urgent assets, not routine patch backlog items. If you cannot patch immediately, prioritise exposure removal before broader hardening work.
What to verify: Confirm that every SharePoint instance is inventoried, each one has a recorded remediation status, and any exception has an expiry date and an owner. Do not assume a single patch campaign covered lab, DR, or legacy nodes.
Decision rule: If the vendor mitigation cannot be applied with confidence, disable external reachability or take the service out of use until you can validate the fix. A reachable unpatched instance is a materially different risk from an isolated one.
Practitioner takeaway: For exploited server code injection, the real control is not just patching, it is proving that the vulnerable path is gone and that no trusted adjacency remains for an attacker to abuse.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- How do you patch or mitigate CVE-2025-49704 (Microsoft SharePoint Code Injection)?
- CVE-2023-24955 (Microsoft SharePoint Server Code Injection)
- How do you patch or mitigate CVE-2020-1350 (Microsoft Windows DNS Server Remote Code Execution)?
- How do you patch or mitigate CVE-2023-21529 (Microsoft Exchange Server Deserialization of Untrusted Data)?