CVE-2024-38094

Microsoft SharePoint's deserialization flaw allowed remote code execution and was actively exploited by ransomware actors.

A deserialization vulnerability in Microsoft SharePoint enabled remote code execution, allowing attackers to execute arbitrary code on affected systems. This failure is critical for DIB organizations because it directly enables ransomware attacks and data breaches, violating CMMC/NIST 800-171 requirements for patch management and system hardening. Organizations must ensure SharePoint is patched to the latest version and monitor for exploitation attempts.

Shame score — A critical deserialization flaw in a widely deployed enterprise platform was actively exploited in the wild by ransomware actors, demonstrating severe negligence in patch management and vulnerability handling.