CVE-2021-28474

What it actually does

CVE-2021-28474 is a remote code execution vulnerability in Microsoft SharePoint Server and SharePoint Foundation. The CVSS vector indicates network-accessible exploitation with low attack complexity and no user interaction, but it requires the attacker to have at least low-privileged authentication. Successful exploitation can allow attacker-controlled code to execute in the context of the SharePoint application/service account, potentially enabling access to SharePoint content, modification of sites or documents, credential theft from the server context, and further movement into connected Microsoft infrastructure depending on privileges and configuration.

Why it matters to the business

An attacker with basic SharePoint credentials could potentially take control of the SharePoint application layer, exposing sensitive documents, disrupting collaboration portals, altering business content, or using the server as a foothold for broader compromise. Although this vulnerability is not currently listed in CISA KEV and no public exploit maturity is indicated, the EPSS probability is relatively elevated, so internet-exposed or broadly accessible SharePoint deployments should treat remediation as high priority. Because SharePoint commonly hosts business-critical documents and workflows, compromise can create legal, operational, and data-loss consequences.

How an attack unfolds

An attacker first obtains or uses an existing low-privileged SharePoint account, such as through credential theft, password reuse, phishing, or compromise of a valid domain identity. They then send a crafted network request to a vulnerable SharePoint endpoint that triggers the remote code execution flaw without requiring interaction from another user. If exploitation succeeds, the malicious payload executes under the SharePoint server process or application pool identity. From there, the attacker may enumerate SharePoint sites and document libraries, access configuration data, deploy persistence such as modified pages or web-accessible files, harvest credentials or tokens available to the application context, and attempt lateral movement to databases, file shares, domain resources, or other Microsoft services integrated with SharePoint.

How to fix it

Apply the applicable Microsoft security updates for SharePoint released for CVE-2021-28474 and ensure all SharePoint servers in each farm are patched consistently. Because no exact fixed versions were provided in the input, administrators should verify patch applicability against the Microsoft Security Update Guide for the deployed SharePoint Foundation or SharePoint Server version. After installing SharePoint updates, run the required SharePoint Products Configuration Wizard or equivalent configuration step on every server in the farm to complete patch application. Restrict SharePoint access to trusted networks where possible, enforce MFA for remote access and administrative accounts, remove unused accounts, and review service account privileges. If immediate patching is not possible, reduce exposure by limiting external access, tightening authentication controls, monitoring for anomalous authenticated requests, and isolating affected servers from sensitive internal systems.

How to confirm the fix worked

Confirm that every SharePoint server in the farm has the relevant Microsoft security update installed and that the SharePoint configuration upgrade step completed successfully. Validate patch state using Windows Update history, installed hotfix/package inventory, SharePoint build numbers, and the Microsoft Security Update Guide mapping for the deployed product version. Ensure there are no unpatched web front ends, application servers, or disaster-recovery nodes. From a network perspective, verify that unauthenticated public access is not available where unnecessary and that authenticated access is limited to intended users and networks. Run authenticated vulnerability scanning with an up-to-date scanner profile for SharePoint Server CVE-2021-28474 and compare results with manual build/package verification.

Typical attack path

1. Acquire valid low-privileged SharePoint or domain credentials.
2. Identify a vulnerable SharePoint Foundation or SharePoint Server instance reachable over the network.
3. Authenticate to SharePoint and send a crafted request to the vulnerable component.
4. Execute attacker-controlled code in the SharePoint application/server context.
5. Enumerate sites, document libraries, users, configuration files, and service account permissions.
6. Establish persistence or deploy tooling through web-accessible paths, scheduled tasks, modified application files, or additional compromised credentials.
7. Use the SharePoint server as a pivot point to access databases, file shares, identity infrastructure, or other internal systems.

How to detect it

To determine whether exploitation has already occurred, review IIS logs for unusual authenticated requests to SharePoint endpoints from unexpected IP addresses, rare user agents, high volumes of POST requests, or requests followed by server errors. Correlate IIS activity with SharePoint ULS logs around the same timestamps for unexpected exceptions, unsafe control loading, serialization/deserialization errors, or application pool instability. Examine Windows Security logs for unusual logons by SharePoint service accounts, unexpected privilege use, new local users, group membership changes, or authentication from the SharePoint server to unrelated internal systems. Review Sysmon or EDR telemetry for SharePoint worker processes such as w3wp.exe spawning command interpreters, PowerShell, scripting engines, LOLBins, archive utilities, or network tools. Inspect SharePoint web directories and layouts/template paths for recently modified ASPX, ASHX, config, DLL, or script files that do not match the expected patch baseline. Review PowerShell logs for encoded commands, web downloads, AMSI bypass attempts, or SharePoint snap-in usage that does not align with administration. Investigate outbound network connections from SharePoint servers to unfamiliar external hosts or newly contacted internal administrative services. Because no unique public exploit string is available from the provided data, detection should focus on authenticated exploitation behavior and post-exploitation artifacts rather than a single request signature.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning net.exe
• w3wp.exe spawning net1.exe
• w3wp.exe spawning nltest.exe
• w3wp.exe spawning whoami.exe
• w3wp.exe spawning ipconfig.exe
• w3wp.exe spawning quser.exe
• w3wp.exe spawning schtasks.exe
• w3wp.exe spawning tasklist.exe
• w3wp.exe spawning procdump.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• IEX(New-Object Net.WebClient).DownloadString
• System.Management.Automation.AmsiUtils
• C:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\CONTROLTEMPLATES\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\CONTROLTEMPLATES\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\ISAPI\\
• C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\ISAPI\\
• .aspx file created under SharePoint TEMPLATE\\LAYOUTS
• .ashx file created under SharePoint TEMPLATE\\LAYOUTS
• Event ID 4688 w3wp.exe cmd.exe
• Event ID 4688 w3wp.exe powershell.exe
• Event ID 7045
• Event ID 4697
• Event ID 4720
• Event ID 4732

What your security team should do

• Prioritize patching all affected SharePoint Foundation and SharePoint Server systems, especially internet-facing or partner-accessible deployments.
• Inventory every SharePoint server in each farm, including web front ends, application servers, search servers, and standby or disaster-recovery systems, to ensure no node remains vulnerable.
• Require MFA and strong conditional access controls for SharePoint access, particularly for remote, privileged, and service-adjacent accounts.
• Review SharePoint service account permissions and remove excessive local administrator, database, or domain privileges where not required.
• Hunt for suspicious authenticated SharePoint activity, unexpected file writes, abnormal PowerShell or command-shell child processes, and newly created persistence mechanisms on SharePoint servers.
• Increase logging for IIS, SharePoint ULS, Windows Security, PowerShell, and endpoint detection telemetry on SharePoint servers.
• If compromise is suspected, rotate SharePoint service account credentials, review database access, and investigate lateral movement from SharePoint servers to domain controllers, SQL servers, file shares, and identity systems.