CVE-2022-37961

What it actually does

CVE-2022-37961 is a Microsoft SharePoint Server remote code execution vulnerability. A network-accessible attacker with low-privileged authenticated access can send crafted requests to a vulnerable SharePoint server and cause attacker-controlled code to run on the server. Successful exploitation can provide code execution in the context of the SharePoint application pool or service account, which may allow access to SharePoint content, modification of site data, deployment of web-accessible payloads, credential theft, and further movement into connected Windows infrastructure.

Why it matters to the business

A compromised SharePoint server can expose sensitive documents, intranet content, collaboration data, and authentication material. Because SharePoint is often integrated with Active Directory, Microsoft Office workflows, and internal business processes, exploitation can lead to data theft, service disruption, tampering with business documents, and a foothold for broader enterprise compromise. Although this vulnerability is not listed in CISA KEV and the provided exploit maturity is none, the EPSS score is elevated and the issue has been public for several years, so unpatched internet-facing or broadly accessible SharePoint deployments should be treated as high priority.

How an attack unfolds

An attacker first obtains or abuses valid SharePoint credentials, which can be low privilege. They identify a vulnerable SharePoint instance and send crafted HTTP requests to the affected SharePoint functionality. If the server is missing the relevant Microsoft security updates, the request triggers the remote code execution condition and runs attacker-controlled code under the SharePoint web application or service context. The attacker may then execute operating system commands, write an ASPX web shell, run PowerShell, dump configuration or credential material, access SharePoint content databases indirectly through the application context, and use the server as a staging point for lateral movement. Post-exploitation commonly focuses on persistence, document theft, privilege escalation, and discovery of domain-connected resources.

How to fix it

Apply the Microsoft security update for CVE-2022-37961 to all affected SharePoint products, including Microsoft SharePoint Server, SharePoint Enterprise Server, and SharePoint Foundation deployments. In practice, this means installing the applicable September 2022 security update or a later cumulative/security update for the exact SharePoint version and language packs in use. After patching, run the SharePoint Products Configuration Wizard or equivalent configuration steps required by Microsoft so the farm schema and binaries are fully updated. If immediate patching is not possible, restrict SharePoint access to trusted networks or VPN, remove unnecessary internet exposure, enforce MFA for SharePoint access paths, disable or limit low-trust accounts, monitor for suspicious authenticated requests, and apply least privilege to SharePoint service accounts. Mitigations should be treated as temporary because the underlying issue requires vendor patching.

How to confirm the fix worked

Confirm every SharePoint server in each farm has the relevant Microsoft SharePoint security update installed and that the SharePoint Products Configuration Wizard has completed successfully on all servers. Validate build numbers against Microsoft’s official SharePoint update history for the deployed product version. Use vulnerability scanners or authenticated patch inventory to verify the host is no longer flagged for CVE-2022-37961. Review Central Administration health status, farm patch status, and upgrade status pages for missing binaries or incomplete configuration. From an exposure perspective, verify that SharePoint endpoints are not unnecessarily internet-facing and that only intended users can authenticate. For additional assurance, inspect IIS, SharePoint ULS, Windows event logs, and EDR telemetry for suspicious activity before and after remediation.

Typical attack path

1. Obtain valid low-privileged SharePoint credentials through phishing, password reuse, credential stuffing, or prior compromise.
2. Discover a reachable Microsoft SharePoint Server instance and determine whether it is missing the September 2022 or later security update that addresses the flaw.
3. Authenticate to SharePoint and send a crafted request to vulnerable functionality that triggers remote code execution.
4. Execute commands in the context of the SharePoint web application or service account.
5. Establish persistence, commonly by writing a web shell or scheduling follow-on execution.
6. Enumerate SharePoint sites, documents, configuration, service accounts, and connected Windows resources.
7. Exfiltrate data, steal credentials, escalate privileges, or move laterally to additional systems.

How to detect it

To determine whether exploitation already occurred, review IIS logs for unusual authenticated POST requests, abnormal request volume, requests from unexpected geographies or user agents, and activity by low-privileged accounts immediately preceding server-side errors or process execution. Examine SharePoint ULS logs for unexpected application errors, access denied patterns followed by successful actions, suspicious page access, and correlation IDs tied to anomalous requests. Review Windows Security logs for unusual logons, privilege use, service creation, scheduled task creation, and account activity around the suspected time window. Use EDR or Sysmon to identify child processes spawned by IIS worker processes or SharePoint services, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or regsvr32.exe. Inspect SharePoint web directories and IIS virtual directories for recently created or modified ASPX, ASHX, or config files that do not match the baseline. Review PowerShell Operational logs for encoded commands, download cradles, web requests, and script block execution under SharePoint-related identities. If compromise is suspected, collect memory, web roots, IIS logs, ULS logs, Windows event logs, scheduled tasks, services, local users, and recent file-system changes before rebuilding or cleaning the host.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> powershell_ise.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• OWSTIMER.EXE -> cmd.exe
• OWSTIMER.EXE -> powershell.exe
• Microsoft.SharePoint.exe -> cmd.exe
• Microsoft.SharePoint.exe -> powershell.exe
• -EncodedCommand
• FromBase64String
• IEX
• Invoke-Expression
• Invoke-WebRequest
• System.Net.WebClient
• DownloadString
• /layouts/
• /_layouts/
• /_vti_bin/
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• .aspx
• .ashx
• EventCode=4688 NewProcessName=*\powershell.exe ParentProcessName=*\w3wp.exe
• EventCode=4688 NewProcessName=*\cmd.exe ParentProcessName=*\w3wp.exe
• EventCode=7045
• schtasks /create
• cmd /c whoami
• cmd /c ipconfig
• cmd /c net user
• cmd /c net group
• cmd /c nltest

What your security team should do

• Inventory all Microsoft SharePoint Server, SharePoint Enterprise Server, and SharePoint Foundation instances, including non-production and legacy farms.
• Prioritize patching internet-facing, partner-facing, and high-sensitivity SharePoint farms first, followed by all remaining deployments.
• Install the applicable Microsoft SharePoint September 2022 or later security/cumulative updates and complete required post-install configuration steps on every farm member.
• Confirm patch levels through authenticated scanning, SharePoint build number review, and farm upgrade status checks.
• Hunt for evidence of prior exploitation, especially child processes spawned by IIS or SharePoint services, suspicious ASPX files, encoded PowerShell, and unusual authenticated SharePoint activity.
• Restrict external access to SharePoint where possible and require MFA for all remote access paths.
• Review SharePoint service account privileges and remove unnecessary local administrator or domain-level permissions.
• Back up SharePoint content, configuration, and farm state before patching and verify restore procedures.
• If suspicious activity is found, preserve logs and disk artifacts, isolate affected servers, rotate credentials used by SharePoint services, and investigate lateral movement.