{"id":"CVE-2021-28474","published":"2021-05-11T19:11:16Z","modified":"2024-08-03T21:47:32Z","title":"Microsoft SharePoint Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","versions":[">= 16.0.0, < 16.0.5161.1000"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","versions":[">= 16.0.0, < 16.0.10374.20000"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Foundation 2013 Service Pack 1","versions":[">= 15.0.0, < 15.0.5345.1000"]}],"description":{"text":"Microsoft SharePoint Server Remote Code Execution Vulnerability","provenance":"source","from":"CVE.org"},"summary":{"text":"A remote code execution flaw in Microsoft SharePoint Enterprise Server 2016 lies within the SharePoint Server component. An attacker with network access and low-privilege authenticated access can execute code remotely, without any user interaction, to affect confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:33Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.50768,"percentile":0.9892,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Hackers Exploit Critical SharePoint Vulnerability for Full Server Takeover","url":"https://otx.alienvault.com/pulse/6881f3b06089312bc783d34d","created":"2025-07-24"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28474","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-574/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[{"id":"SRC-e7dfbcdaedcbed88ea81","title":"SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770)","publisher":"research.eye.security","url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","mentions":[{"quote":"Based on us reading about CVE-2021-28474, we learned how the mass exploitation used the ASPX payload to maintain persistence, even after patching: utilizing the way SharePoint handles __VIEWSTATE.","start":14520,"end":14716},{"quote":"In the original CVE-2021-28474, attackers abused the server-side control parsing logic in SharePoint pages to inject unexpected objects into the page lifecycle.","start":14720,"end":14880},{"quote":"GET request to malicious ASPX file in /_layouts/15/spinstall0.aspx – aspx crypto dumper used by CVE-2021-28474 with tool ysoserial to get RCE on SharePoint","start":26825,"end":26980}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-15152","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-15152","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-28474","provenance":"source"},{"date":"2025-07-19","kind":"report","label":"Named in research.eye.security: SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Resea…","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":30.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.78,"detail":"percentile 0.9892"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}