7.2

CVE-2024-38094: Microsoft SharePoint Deserialization Vulnerability

KEVRansomware
Analyzed
Published 09-07-2024Last modified 10-02-2026

Vulnerability summary

CVE-2024-38094 is a high (CVSS 7.2) Deserialization of Untrusted Data vulnerability in Microsoft SharePoint. It is known to be exploited: CISA lists it, first on 22-10-2024. It has been used in ransomware campaigns. EPSS estimates a 50.89% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.2/10
010
High · v3.1 (CVE.org)
EPSS score
50.89%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Timeline

  1. 09-07-2024
    PublishedVulnerability first disclosed.
  2. 22-10-2024
    Added to CISA KEVExploitedMicrosoft SharePoint Deserialization Vulnerability
  3. 12-11-2024
    CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 10-02-2026
    Last modifiedVulnerability information updated.

Description

Microsoft SharePoint Remote Code Execution Vulnerability

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

50.89%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 50.89% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
22-10-2024
Federal due date
12-11-2024
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 nvd.nist.gov/vuln/detail/CVE-2024-38094

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Microsoft4 products

1 vendor · 4 products

References

2 links