Cyber Resilience

CVE-2022-38053

Microsoft Sharepoint Enterprise Server 2013 … 2016

High EPSS
Published
11 October 2022
Modified
02 January 2025
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.76 99.5th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2022-38053 is a high-severity an unspecified weakness vulnerability in Microsoft Sharepoint Enterprise Server. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-6 (Least Privilege) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Microsoft SharePoint Server is affected by CVE-2022-38053, a remote code execution vulnerability disclosed on 2022-10-11. The flaw carries a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that an authenticated attacker can achieve full compromise of confidentiality, integrity, and availability over the network with low attack complexity.

An attacker who possesses low-privileged access to a SharePoint deployment can exploit the vulnerability to execute arbitrary code on the server without user interaction, resulting in complete takeover of the affected SharePoint instance and any data it processes.

Microsoft has published official guidance and patches for the issue through its Security Response Center at the referenced URLs, directing administrators to apply the relevant updates for supported SharePoint Server versions.

EPSS for the CVE rose from a low baseline to a peak of 0.5244 on 2025-12-11 before receding to the current value of 0.2852, indicating that exploitation interest increased well after initial disclosure.

EU & UK References

Vulnerability Data

Microsoft SharePoint Server Remote Code Execution Vulnerability

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Authenticated remote code execution on a public-facing SharePoint Server directly enables exploitation of the application over the network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: HIGH
Successful exploitation grants the attacker the ability to execute arbitrary code on the SharePoint server.
attack.mitre.org →
T1213.002 Sharepoint Collectionconfidence: MEDIUM
Compromise of the SharePoint server provides direct access to data stored in SharePoint repositories.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-1181Same product: Microsoft Sharepoint Enterprise Server
CVE-2020-16952Same product: Microsoft Sharepoint Enterprise Server
CVE-2019-0604Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-21717Same product: Microsoft Sharepoint Enterprise Server
CVE-2022-35823Same product: Microsoft Sharepoint Enterprise Server
CVE-2022-37961Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-24955Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-24950Same product: Microsoft Sharepoint Enterprise Server
CVE-2023-21742Same product: Microsoft Sharepoint Foundation
CVE-2022-44690Same product: Microsoft Sharepoint Foundation

Affected Assets

microsoft
sharepoint enterprise server
2013, 2016
microsoft
sharepoint foundation
2013
microsoft
sharepoint server
2019, all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • AC-6 Least Privilege
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely installation of vendor patches that eliminate the SharePoint RCE flaw before exploitation.

AC-6 Least Privilege partial match
prevent

Restricts the low-privileged authenticated accounts that the vulnerability requires for successful code execution.

CM-7 Least Functionality partial match
prevent

Limits enabled SharePoint features and services that could be abused to reach the vulnerable code path.

References