CVE-2024-38094
Microsoft SharePoint Deserialization Vulnerability
Published Jul 9, 2024 · updated Jun 17, 2026 · microsoft sharepoint server
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Timeline
Detection, updates, and resolution for this record.
Jul 9, 2024 · Catalog
Detected
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Oct 22, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Nov 12, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 12, 2024
Affected
- cpe microsoft/sharepoint serverversion unspecified
- cpe microsoft/sharepoint server2016
- cpe microsoft/sharepoint server2019
- vendor Microsoft SharePointversion unspecified
Sources
- CISA KEVCVE-2024-38094
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
cisa.gov - CVE.orgCVE-2024-38094
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-38094
30-day exploitation probability 50.9%
first.org - NIST NVDCVE-2024-38094
Microsoft SharePoint Remote Code Execution Vulnerability
nvd.nist.gov