CVE-2022-44690

Deeper analysis

Microsoft SharePoint Server is affected by CVE-2022-44690, a remote code execution vulnerability disclosed on December 13, 2022. The flaw carries a CVSS 3.1 base score of 8.8 with an attack vector of network, low attack complexity, and low privileges required, allowing an authenticated attacker to execute arbitrary code with impacts to confidentiality, integrity, and availability.

An attacker with low-privileged access to a SharePoint deployment can exploit the vulnerability over the network without user interaction to achieve full remote code execution on the server. This enables the attacker to run malicious code, access sensitive data, modify content, or disrupt service operations within the affected SharePoint environment.

Microsoft has published guidance for the vulnerability in its security update guide at the referenced advisory URL, which includes details on available patches and mitigation steps for supported SharePoint Server versions. The associated EPSS score reached a peak of 0.3860 with a current value of 0.3022, indicating moderate and sustained exploitation interest following disclosure.