CVE detail
CVE-2023-24955
Microsoft SharePoint Server Remote Code Execution Vulnerability
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 23.0 · diversity 14.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
9 source links · newest first
s deployments. Key Takeaways CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS machine keys and deploy malware for persistence. Two additional SharePoint Server vulnerabilities disclosed
vendorwww.tenable.comJul 16, 2026, 4:00 PM- Week in review: Backdoor found in XZ utilities, weaponized iMessages, Exchange servers at riskHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: XZ Utils backdoor update: Which Linux distros are affected and what can you do? A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in most Linux distributions, may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” Red Hat warns. Strengthening critical infrastructure cybersecurity is a balancing act In … More →
newswww.helpnetsecurity.comMar 31, 2024, 8:00 AM - Patch actively exploited Microsoft SharePoint bug, CISA orders federal agencies (CVE-2023-24955)Help Net Security
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-24955 – a code injection vulnerability that allows authenticated attackers to execute code remotely on a vulnerable Microsoft SharePoint Server – to its KEV catalog and is demanding that US federal civilian agencies implement the patch for it by April 16. As per usual, details about the attack in which the flaw is leveraged have not been shared. About CVE-2023-24955 and CVE-2023-29357 CVE-2023-24955 and CVE-2023-29357, a … More →
newswww.helpnetsecurity.comMar 28, 2024, 10:20 AM - CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalogSecurity Affairs
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the 2023 Pwn2Own to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2023-24955 Microsoft SharePoint Server Code Injection Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft addressed the remote code execution flaw in SharePoint Server, […]
newssecurityaffairs.comMar 27, 2024, 3:11 PM CISA says a second SharePoint vulnerability demonstrated last year at Pwn2Own, CVE-2023-24955, has been exploited in the wild.
newswww.securityweek.comMar 27, 2024, 9:49 AMA patched privilege escalation vulnerability impacting Microsoft SharePoint servers has been added to the known exploited vulnerabilities (KEV) catalog of the US Cybersecurity and Infrastructure Security Agency (CISA). Citing evidence of active exploitation, CISA has tagged the critical severity bug Microsoft previously released fixes for as part of its June 2023 Patch Tuesday updates. Tracked […]
newswww.csoonline.comJan 12, 2024, 1:07 PMMicrosoft Patch Tuesday Security updates for May 2023 address a total of 40 vulnerabilities, including two zero-day actively exploited in attacks. Microsoft’s May 2023 security updates address 40 vulnerabilities, including two zero-day flaws actively exploited in attacks. The flaws affect Microsoft Windows and Windows Components; Office and Office Components; Microsoft Edge (Chromium-based); SharePoint Server; Visual […]
newssecurityaffairs.comMay 10, 2023, 5:23 AMMicrosoft’s May 2023 security updates address a total of 40 newly documented vulnerabilities, including two flaws already exploited in attacks.
newswww.securityweek.comMay 9, 2023, 7:21 PM- Microsoft fixes two actively exploited bugs, one used by BlackLotus bootkit (CVE-2023-29336, CVE-2023-24932)Help Net Security
For May 2023 Patch Tuesday, Microsoft has delivered fixes for 38 CVE-numbered vulnerabilities, including a patch for a Windows bug (CVE-2023-29336) and a Secure Boot bypass flaw (CVE-2023-24932) exploited by attackers in the wild. The two exploited bugs (CVE-2023-29336, CVE-2023-24932) CVE-2023-29336 is a vulnerability that allows attackers to gain SYSTEM privileges. Flagged by researchers with AV maker Avast, it seems probable that it’s being exploited to deliver malware. Microsoft has offered no details about the … More →
newswww.helpnetsecurity.comMay 9, 2023, 6:58 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2022-41061CVSS 7.8 · High
Microsoft Word Remote Code Execution Vulnerability
- CVE-2021-42309CVSS 8.8 · High
Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2021-40487CVSS 8.1 · High
Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2021-31181CVSS 8.8 · High
Microsoft SharePoint Remote Code Execution Vulnerability
- CVE-2018-8284CVSS 8.1 · High
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This aff…
- CVE-2025-49704CVSS 8.8 · High
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.