CVE-2024-21426: Microsoft SharePoint Server RCE Vulnerability

CVE-2024-21426 Overview

CVE-2024-21426 is a remote code execution vulnerability affecting Microsoft SharePoint Server. The flaw is rooted in a use-after-free condition [CWE-416] within the SharePoint Server codebase. Despite carrying a remote code execution label, the CVSS vector indicates a local attack vector requiring user interaction, so exploitation depends on convincing a user to open a crafted file or trigger a specific action. Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability. Microsoft addressed the issue through its March 2024 Patch Tuesday security update guide.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary code in the context of SharePoint Server, compromising hosted content, credentials, and downstream integrations.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2016 Enterprise
Microsoft SharePoint Server 2019

Discovery Timeline

2024-03-12 - CVE-2024-21426 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21426

Vulnerability Analysis

CVE-2024-21426 is a use-after-free vulnerability [CWE-416] in Microsoft SharePoint Server. The condition arises when the application references memory after it has been released, allowing an attacker to influence what occupies that freed memory. When SharePoint later dereferences the stale pointer, attacker-controlled data can redirect program execution.

Because the attack vector is local and requires user interaction, an attacker must trick an authenticated user into opening a specially crafted document or performing an action that reaches the vulnerable code path. Once triggered, the flaw yields code execution within the SharePoint process context, providing access to farm data, service accounts, and internal service endpoints.

The EPSS score of roughly 3.9% places this vulnerability in the top tier of likelihood-to-be-exploited relative to the broader CVE population, though no public proof-of-concept has been observed and CISA has not added it to the Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper memory lifetime management in a SharePoint Server component. An object is freed while a reference remains active, and subsequent use of that reference operates on memory that may have been reallocated with attacker-influenced content.

Attack Vector

Exploitation requires local access and user interaction. A crafted file or client-side interaction triggers the vulnerable code path in SharePoint Server. Microsoft has not published exploitation-specific technical details. See the Microsoft Security Update Guide for CVE-2024-21426 for the authoritative advisory.

No verified public exploit code exists for this CVE at this time.

Detection Methods for CVE-2024-21426

Indicators of Compromise

No public indicators of compromise have been published for CVE-2024-21426.
Unexpected child processes spawning from w3wp.exe under the SharePoint application pool identity warrant investigation.
Anomalous file writes into SharePoint hive directories such as %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\ outside of patch windows.

Detection Strategies

Monitor SharePoint Windows Event Logs and Unified Logging Service (ULS) logs for exceptions and unexpected worker process restarts.
Alert on process creation events where w3wp.exe spawns interpreters like cmd.exe, powershell.exe, or cscript.exe.
Correlate authenticated file uploads with subsequent outbound network connections from SharePoint servers to previously unseen destinations.

Monitoring Recommendations

Track SharePoint patch level across the farm and alert on servers running builds prior to the March 2024 security update.
Baseline normal script and binary execution patterns on SharePoint servers and alert on deviations.
Forward SharePoint host telemetry, IIS logs, and ULS logs to a centralized analytics platform for retrospective hunting.

How to Mitigate CVE-2024-21426

Immediate Actions Required

Apply the March 2024 Microsoft security updates for SharePoint Server Subscription Edition, 2019, and 2016 across all farm servers.
Inventory all SharePoint deployments and verify build numbers post-patch using (Get-SPFarm).BuildVersion in the SharePoint Management Shell.
Restrict local and interactive access to SharePoint servers to a minimal set of administrators.
Review recent SharePoint audit logs for anomalous document uploads or user-driven interactions preceding server instability.

Patch Information

Microsoft published fixes in the March 12, 2024 Patch Tuesday release. Refer to the Microsoft Security Update Guide for CVE-2024-21426 for build-specific KB articles and download links for each supported SharePoint Server edition.

Workarounds

No vendor-supplied workarounds are documented; patching is the required remediation path.
Reduce exposure by enforcing least-privilege on SharePoint service accounts and application pool identities.
Constrain document upload permissions and enable antimalware scanning on SharePoint content ingestion points.
Segment SharePoint servers from general workstation networks to limit adversary movement following exploitation.

bash

# Verify SharePoint farm build version after patching
Add-PSSnapin Microsoft.SharePoint.PowerShell
(Get-SPFarm).BuildVersion

# List installed SharePoint security updates
Get-HotFix | Where-Object { $_.Description -eq 'Security Update' } | Sort-Object InstalledOn -Descending