CVE-2024-49070: Microsoft SharePoint Server RCE Vulnerability

CVE-2024-49070 Overview

CVE-2024-49070 is a remote code execution vulnerability affecting Microsoft SharePoint Server. The flaw is rooted in insecure deserialization of untrusted data ([CWE-502]) within the SharePoint Server application stack. An authenticated attacker with local access can exploit deserialization logic to execute arbitrary code within the SharePoint process context.

Microsoft published guidance for CVE-2024-49070 on December 12, 2024. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The EPSS score of 2.248% places it in the 81st percentile for exploitation likelihood among tracked CVEs.

Critical Impact
Successful exploitation allows arbitrary code execution against SharePoint Server with high confidentiality, integrity, and availability impact.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2024-12-12 - CVE-2024-49070 published to NVD
2024-12-12 - Microsoft releases security update guidance
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49070

Vulnerability Analysis

CVE-2024-49070 is an insecure deserialization vulnerability [CWE-502] in Microsoft SharePoint Server. SharePoint processes serialized objects during specific application operations. When the deserialization routine reconstructs an attacker-controlled object graph, it can invoke gadget chains that execute arbitrary code within the SharePoint worker process.

The attack complexity is rated high because exploitation depends on specific conditions being present in the target environment. The attack vector is local, meaning the attacker must operate against a component reachable through local access paths rather than directly across the network. Successful exploitation compromises the confidentiality, integrity, and availability of data managed by SharePoint.

Root Cause

The root cause is unsafe reconstruction of serialized objects without adequate type filtering or integrity validation. SharePoint accepts serialized payloads and passes them through a deserializer that instantiates types capable of triggering code execution during object graph reconstruction. This class of flaw is well documented in .NET applications that use BinaryFormatter, LosFormatter, ObjectStateFormatter, or similar unsafe serializers without a strict allow list.

Attack Vector

Exploitation requires no user interaction and no prior authentication in the CVSS scoring model, but the attacker must reach the vulnerable component through a local access path. An attacker crafts a serialized payload containing a gadget chain that resolves to code execution when deserialized. The payload is delivered to the vulnerable SharePoint endpoint and processed by the deserializer, resulting in arbitrary code execution under the SharePoint service account.

No public proof-of-concept exploit is currently available in ExploitDB or vendor advisories. Microsoft has not reported CVE-2024-49070 as exploited in the wild, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. For deserialization mechanics, refer to the Microsoft Security Update CVE-2024-49070 advisory.

Detection Methods for CVE-2024-49070

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under a SharePoint application pool identity, particularly cmd.exe, powershell.exe, or script hosts.
Anomalous outbound network connections originating from SharePoint web front-end servers to previously unseen destinations.
New or modified .aspx files, web shells, or scheduled tasks appearing in SharePoint content directories such as C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\.
SharePoint ULS logs containing deserialization exceptions or stack traces referencing BinaryFormatter, LosFormatter, or ObjectStateFormatter.

Detection Strategies

Monitor Windows Event Logs and IIS logs on SharePoint servers for POST requests to serialization-handling endpoints followed by process creation events.
Correlate Sysmon Event ID 1 (process create) with parent process w3wp.exe to identify code execution originating from SharePoint worker processes.
Apply behavioral detections that flag SharePoint service accounts launching interpreters, encoded PowerShell, or credential access utilities.

Monitoring Recommendations

Enable and forward SharePoint ULS logs, IIS logs, and Sysmon telemetry to a centralized SIEM for correlation.
Track file integrity on SharePoint LAYOUTS, ISAPI, and content directories to detect unauthorized web shell placement.
Alert on service account authentication anomalies and lateral movement attempts originating from SharePoint hosts.

How to Mitigate CVE-2024-49070

Immediate Actions Required

Apply the December 2024 SharePoint security updates published in the Microsoft Security Update CVE-2024-49070 advisory to all affected SharePoint Server instances.
Inventory SharePoint Server 2016, 2019, and Subscription Edition deployments and confirm patch level after installation.
Restrict local and network access to SharePoint administrative interfaces to trusted management networks only.
Review SharePoint service account privileges and remove unnecessary local administrator rights on the host.

Patch Information

Microsoft released security updates for CVE-2024-49070 on December 12, 2024. Administrators should apply the cumulative security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise as documented in the Microsoft Security Update CVE-2024-49070 guidance. Verify build numbers after patching and restart the affected services to complete installation.

Workarounds

Where patching is delayed, restrict access to SharePoint Server hosts through network segmentation and host-based firewalls.
Enforce least privilege for SharePoint application pool identities to limit the scope of code execution if exploitation occurs.
Enable AMSI integration for SharePoint on supported versions to inspect suspicious payloads processed by the server.
Increase logging verbosity on SharePoint ULS and IIS to accelerate detection of exploitation attempts until patches are applied.