Is CVE-2023-24955 (Microsoft SharePoint Server Code Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-24955 to its Known Exploited Vulnerabilities catalogue on 26 March 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.

What “Exploited in the Wild” Means for This CVE

For a vulnerability question like this, “exploited in the wild” is more than a theoretical concern. It means the issue has crossed from disclosure into active attacker use, so the practical question becomes whether your SharePoint Server instances are exposed, whether the required CISA action has been applied, and whether you need to assume attempted or successful abuse already occurred.

The important operational distinction is that exploitation status changes priority, not just urgency. A vulnerability that is already on the CISA KEV catalogue should be handled as an active defense problem, not as a normal backlog item. That is why the first step is confirming whether the affected product is present anywhere in your environment, including externally reachable farms and systems that may not be centrally managed.

Use the CISA Known Exploited Vulnerabilities Catalog as the operational trigger and the CVE Program record as the identifier source, but let vendor guidance decide the exact remediation path and ordering.

How to Confirm Exposure and Prioritise Remediation

Start with exposure confirmation, not with generic patching language. You need to know where Microsoft SharePoint Server is deployed, whether any instance is internet facing, which business units depend on it, and whether administrative ownership is clear enough to act quickly. If a system is still running the vulnerable code path, it should be treated as a live exposure until the required action is completed.

Because CISA only adds entries when there is reliable evidence of active exploitation, KEV-listed issues deserve exception handling rather than standard change windows. For remediation triage, prioritise internet-exposed systems, privileged content management environments, and farms that support high-value document repositories or workflow systems. Those are the places where successful code injection has the highest operational and security impact.

For prioritisation support, FIRST EPSS can help rank exploitation likelihood across your broader backlog, while NIST Cybersecurity Framework 2.0 provides a governance lens for asset inventory, protective action, detection, and recovery.

What to Do If Patch Timing Is Constrained

If immediate remediation is not possible, treat the environment as temporarily exposed and reduce attack opportunity as much as you can. Restrict administrative access, limit who can reach the SharePoint application tier, harden adjacent management interfaces, and watch closely for unusual child processes, scripting activity, or unexpected outbound connections from the SharePoint host. Those are the kinds of signals that can indicate a successful code injection attempt or post-exploitation activity.

You should also plan for the possibility that the vulnerability was used before you could remediate it. That means checking logs for suspicious requests, unexpected application behavior, new files or web content, unusual privilege use, and signs that the server was leveraged as a launch point into the wider environment. In practice, the question is not only whether the patch is delayed, but whether the delay created time for compromise.

Where the issue is part of a broader web attack pattern, the Web Application Attacks Guide is a useful companion for understanding common injection paths and what defenders usually miss during review.

Risk and Threat Considerations

Code injection in a collaboration platform is dangerous because it can turn an authenticated application path into a foothold for arbitrary execution. Once an attacker reaches that state, the blast radius can extend well beyond the initial server, especially if the SharePoint farm has access to sensitive content, service credentials, or internal network resources.

Failure mechanism: An attacker with legitimate Site Owner privileges can abuse the vulnerable SharePoint Server code path to run malicious code, then use that execution to expand access, stage payloads, or prepare follow-on intrusion activity.

Impact: Successful exploitation can lead to content exposure, system compromise, persistence, lateral movement, and, where ransomware operators are present, a much faster path from initial foothold to enterprise-wide disruption.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Inventories of Physical Devices and Systems	Exposure confirmation depends on knowing where SharePoint servers exist.
	PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited	Site Owner authentication and privileged access shape exploitation risk and response.
	DE.CM-01 — Networks and network services are monitored	Monitoring is needed to spot exploitation attempts and post-compromise activity.
Recommendation — Inventory all SharePoint servers and external entry points before you triage remediation. Review and restrict privileged SharePoint access while remediation is pending. Monitor SharePoint hosts and adjacent services for unusual execution and outbound activity.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is an actively exploited software flaw requiring urgent remediation.
	RA-5 — Vulnerability Monitoring and Scanning	You need continuous visibility into where the exposed product exists and remains vulnerable.
	SI-4 — System Monitoring	Exploitation review depends on detecting suspicious server-side activity and abuse.
Recommendation — Apply the required fix or mitigation for the vulnerable SharePoint Server deployment. Continuously identify SharePoint systems that remain exposed to the CVE. Investigate SharePoint logs and host telemetry for signs of exploitation or persistence.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation demands urgent identification and remediation tracking.
	CIS-10 — Malware Defenses	Post-exploitation activity may introduce payloads, persistence, or lateral movement.
	CIS-12 — Network Infrastructure Management	Reducing exposure and access paths is part of constraining active exploitation risk.
Recommendation — Prioritise and track remediation for the vulnerable SharePoint Server fleet. Hunt for malicious tooling and payload delivery on affected SharePoint systems. Restrict unnecessary network reachability to exposed SharePoint servers.

Practitioner Guidance

What to verify: Confirm every SharePoint Server instance, every administrative owner, and every external exposure point before you assume the vulnerability is contained. If you cannot quickly prove inventory completeness, treat the environment as higher risk until you can.

Decision rule: If the system is KEV-listed and reachable in production, prioritise emergency remediation and compromise review over routine scheduling. If patching must wait, document the exception, reduce access, and increase monitoring immediately.

Practitioner takeaway: For a KEV-listed SharePoint vulnerability, the right question is not just “is it exploited,” but “can I still trust this server’s current state if it has not yet been remediated or checked for compromise?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org