CVE-2024-38094 Microsoft SharePoint Deserialization Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Known to be used

Weakness CWE-502

Description

Microsoft SharePoint Remote Code Execution Vulnerability

Affected products and versions

Product	Affected versions	Fixed in
Microsoft SharePoint Enterprise Server 2016 16.0	16.0.0 → < 16.0.5456.1000	16.0.5456.1000
Microsoft SharePoint Server 2019 16.0	16.0.0 → < 16.0.10412.20001	16.0.10412.20001
Microsoft SharePoint Server Subscription Edition 16.0	16.0.0 → < 16.0.17328.20424	16.0.17328.20424

Other CVEs of Microsoft SharePoint Enterprise Server 2016

The 337 CVEs of Microsoft SharePoint Enterprise Server 2016 →

CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint… 8.1 High CVE-2026-69943 Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows… 8.8 High CVE-2026-62917 Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a… 4.6 Medium CVE-2026-62839 Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing… 6.5 Medium