An authenticated attacker can exploit improper access control in Microsoft SharePoint Server Subscription Edition to execute arbitrary code, posing a high risk of total system compromise.

This vulnerability is caused by improper access control, classified as CWE-284, which permits an authenticated attacker to execute code over the network. The vulnerability requires the attacker to have low-level privileges to interact with the vulnerable SharePoint instance.

The potential for unauthorized remote code execution represents a critical threat to organizational data integrity and confidentiality. Given the CVSS score of 8.8, this vulnerability allows an attacker to gain significant control over the SharePoint environment, which could lead to unauthorized data exfiltration, lateral movement within the network, or complete service disruption.

Immediate Action: Apply the vendor-provided security update to upgrade the software to version 16.0.20326.20082 or later.

Proactive Monitoring: Review SharePoint access logs for unusual administrative activity or unauthorized attempts to execute scripts and commands from low-privileged user accounts.

Compensating Controls: Implement strict network segmentation and ensure that the SharePoint instance is not exposed to the public internet, using a Web Application Firewall to filter suspicious traffic patterns.

Public Exploit Available: No

Due to the severity of remote code execution, it is imperative that IT administrators prioritize the deployment of the update to version 16.0.20326.20082. Organizations should verify that all SharePoint Server instances are updated in accordance with Microsoft guidelines to mitigate the risk of unauthorized command execution.