CVE-2022-44690

What it actually does

CVE-2022-44690 is a Microsoft SharePoint Server remote code execution vulnerability. The CVSS vector indicates network-accessible exploitation with low attack complexity, no user interaction, and low privileges required. A successful attacker who can authenticate to the SharePoint application can cause SharePoint to execute attacker-controlled code in the context of the SharePoint service/application pool account, potentially allowing access to SharePoint content, modification of application data, lateral movement using service-account privileges, and disruption of the SharePoint service.

Why it matters to the business

A compromised SharePoint server can expose sensitive documents, internal collaboration data, credentials stored in content or configuration, and business workflows hosted on SharePoint. Because SharePoint is often internet-facing or broadly reachable by internal users, exploitation can lead to data theft, unauthorized content changes, malware staging, and operational disruption. The high EPSS score indicates a relatively elevated probability of exploitation activity compared with many vulnerabilities, so organizations running affected SharePoint Foundation or SharePoint Server versions should treat remediation as high priority even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains or uses a low-privileged SharePoint account that can reach the vulnerable SharePoint site. They then send crafted network requests to vulnerable SharePoint functionality that mishandles attacker-controlled input and triggers code execution on the server. If exploitation succeeds, the attacker gains execution under the SharePoint web application or service context. From there, they may deploy a web shell, run command interpreters or PowerShell, enumerate SharePoint configuration and content databases, harvest credentials or tokens, modify site content, and use the compromised server as a foothold for further internal reconnaissance and lateral movement.

How to fix it

Apply the Microsoft security updates for SharePoint released to address CVE-2022-44690 and ensure the SharePoint farm build level reflects the relevant patched cumulative/security update for every server in the farm. Because no fixed versions were provided in the input, use Microsoft’s official Security Update Guide and SharePoint build-number documentation to identify the correct update for the deployed SharePoint Foundation or SharePoint Server edition. Patch all SharePoint roles, including web front ends and application servers, then run any required SharePoint Products Configuration Wizard/psconfig steps to complete the update. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, enforcing MFA for SharePoint users where applicable, disabling or limiting unnecessary low-privileged accounts, monitoring authenticated activity closely, and ensuring the SharePoint service accounts do not have excessive privileges outside the SharePoint farm.

How to confirm the fix worked

Confirm that every SharePoint server in the farm has the Microsoft security update installed and that SharePoint configuration steps completed successfully. Validate the installed SharePoint build numbers against Microsoft’s patched build guidance. Review Central Administration upgrade status, server patch status, Windows Update history, and installed update inventory. From an exposure perspective, verify that SharePoint is not unnecessarily internet-accessible and that authentication is required. Perform an authenticated vulnerability scan or configuration assessment with current SharePoint checks to confirm CVE-2022-44690 is no longer reported. Also verify that no unexpected web-accessible files, unauthorized timer jobs, suspicious service-account activity, or anomalous child processes remain after patching.

Typical attack path

1. Identify internet-facing or internally reachable Microsoft SharePoint Foundation or SharePoint Server instances.
2. Obtain valid low-privileged SharePoint credentials through phishing, password reuse, credential stuffing, or prior compromise.
3. Fingerprint the SharePoint version and patch level using HTTP responses, page metadata, or authenticated access.
4. Send crafted authenticated requests to the vulnerable SharePoint endpoint or functionality to trigger remote code execution.
5. Execute commands in the context of the SharePoint application pool or service account.
6. Establish persistence, commonly by writing a web shell or scheduled task if permissions allow.
7. Enumerate SharePoint content, configuration, service credentials, and connected systems.
8. Exfiltrate data, modify content, deploy additional tooling, or pivot deeper into the network.

How to detect it

To determine whether exploitation already occurred, review IIS logs for SharePoint web applications, SharePoint ULS logs, Windows Security event logs, PowerShell logs, Sysmon or EDR telemetry, and file-system changes under SharePoint web roots. Focus on authenticated requests from unusual users, unexpected source IPs, high-volume POST activity, suspicious uploads, and access to newly created .aspx/.ashx/.asmx files. Hunt for child processes spawned by IIS/SharePoint worker processes such as w3wp.exe launching cmd.exe, powershell.exe, rundll32.exe, mshta.exe, certutil.exe, bitsadmin.exe, cscript.exe, wscript.exe, or regsvr32.exe. Review Event ID 4688 or Sysmon Event ID 1 for process creation by SharePoint application pool identities. Check for unexpected files in SharePoint layouts, hive, inetpub, and web application directories. Review SharePoint timer jobs, solution packages, feature activations, and administrator role changes for unauthorized modifications. If suspicious activity is found, preserve IIS logs, ULS logs, memory/process telemetry, web directories, and relevant Windows event logs before remediation.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> net.exe
• w3wp.exe -> net1.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.ashx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.asmx
• POST /_layouts/
• POST /_vti_bin/
• POST /_api/
• Event ID 4688 New Process Name: C:\Windows\System32\cmd.exe Parent Process Name: w3wp.exe
• Event ID 4688 New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Parent Process Name: w3wp.exe
• Sysmon Event ID 1 ParentImage: *\w3wp.exe Image: *\cmd.exe
• Sysmon Event ID 1 ParentImage: *\w3wp.exe Image: *\powershell.exe

What your security team should do

• Prioritize patching affected Microsoft SharePoint Foundation and SharePoint Server farms because the vulnerability allows authenticated remote code execution and has a high EPSS score.
• Inventory all SharePoint servers, including web front ends, application servers, legacy Foundation deployments, development farms, and disaster-recovery systems.
• Ensure the same security update level is applied across every server in each SharePoint farm and complete required psconfig/SharePoint Products Configuration Wizard steps.
• Restrict SharePoint administrative and user access to trusted networks where feasible, especially for externally exposed deployments.
• Harden and monitor SharePoint service accounts; remove unnecessary local administrator, domain administrator, or broad database privileges.
• Review SharePoint and IIS logs for suspicious authenticated requests, uploads, web shell access, and abnormal POST activity around the publication date and afterward.
• Hunt for suspicious child processes spawned by SharePoint/IIS worker processes, including command shells, PowerShell, script interpreters, and archive utilities.
• Check SharePoint web directories and writable content locations for unauthorized .aspx, .ashx, .asmx, or script files.
• Rotate credentials for SharePoint service accounts if compromise is suspected or if suspicious code execution artifacts are found.
• Add SIEM detections for SharePoint server process spawning, web shell patterns, and unusual authenticated activity from low-privileged users.