CVE-2023-24955

An authenticated attacker with Site Owner privileges could remotely execute code via a code injection vulnerability in Microsoft SharePoint Server.

This unpatched vulnerability allowed remote code execution for authenticated attackers holding Site Owner privileges, directly enabling ransomware deployment and data exfiltration. DIB organizations must ensure SharePoint is patched and least-privilege access is enforced to prevent similar compromises. The failure stems from neglecting to apply known security updates, leading to an actively exploited, ransomware-linked breach.

Shame score — A known, unpatched code injection flaw was actively exploited in the wild to deploy ransomware, demonstrating severe negligence and avoidable risk.