CERT-EU 2026-03-25

2026-004: Critical Vulnerability in SharePoint Exploited

Machine-generated analysis · WAYSCloud LLM

Microsoft updated its advisory to state that this SharePoint RCE vulnerability can now be exploited by unauthenticated attackers. CISA added it to the Known Exploited Vulnerabilities catalog.

Context

The vulnerability affects Microsoft SharePoint, a collaboration and document management platform. The advisory notes the vulnerability permits remote code execution and has been exploited. Microsoft revised its severity assessment after initial disclosure.

Operator considerations

Patch: Update SharePoint servers immediately as per Microsoft's March 2026 release
Isolate: Prioritize updating internet-facing SharePoint assets

From Computer Emergency Response Team for the EU institutions ↗

On 17 March 2026, Microsoft updated one of its January 2026 security advisories related to a remote code execution vulnerability in Microsoft SharePoint. Specifically, Microsoft raised the CVSS score and changed the FAQ section to indicate that the vulnerability could be exploited by an unauthenticated attacker. This vulnerability was added in the CISA's Known Exploited Vulnerabilities (KEV) catalogue on 18 March 2026.

Additionally, three further RCE flaws affecting Microsoft SharePoint were addressed in the March 2026 release.

CERT-EU strongly recommends updating SharePoint servers as soon as possible, prioritising internet-facing assets. CERT-EU also encourages IT administrators to take necessary remediation actions.

Read the full advisory on CERT-EU →