Threat actors are actively exploiting CVE-2024-38094 (CVSS 7.2), a high-severity deserialization flaw affecting on-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition. The vulnerability stems from insufficient input verification during the deserialization of untrusted XML payloads transmitted to the SharePoint client API. An attacker with Site Owner privileges can inject crafted serialized data to trigger arbitrary code execution within the context of the IIS worker process (w3wp.exe) running under the SharePoint service account.

Incident response findings by Rapid7 confirmed that adversaries weaponized public proof-of-concept exploits against exposed SharePoint servers to plant web shells and compromise Microsoft Exchange service accounts possessing domain administrator rights. For defense evasion, the threat actors deployed Huorong Antivirus to induce driver conflicts that terminated legitimate endpoint detection agents before leveraging Impacket to traverse the internal network. CISA has added CVE-2024-38094 to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to remediate affected systems.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Insecure object deserialization within enterprise collaboration platforms allows authenticated adversaries to execute server-side code, breach service isolation boundaries, and weaponize shared service accounts to achieve full Active Directory domain compromise.
• Bullet 2 — Strategic & Defender Imperative: Security teams must immediately apply Microsoft updates to all on-premises SharePoint farms, isolate web interfaces behind zero-trust access controls, strip administrative domain privileges from service accounts, and alert on unauthorized driver installations or EDR interference.