Improper neutralization of special elements used in an OS command ('os command injection') in Microsoft Office SharePoint permits an authorized attacker to execute code over the network. The flaw allows the attacker to supply crafted input that is passed to the underlying operating system without proper escaping, enabling execution of arbitrary commands with the privileges of the SharePoint process. This results in remote code execution on the SharePoint server, potentially compromising confidentiality, integrity, and availability of the server and any services that rely on it.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition are all affected. No specific version constraints are listed by Microsoft, so the vulnerability applies to all current releases of these products. The impact applies to the SharePoint web applications hosted on these servers.

The CVSS score of 8 indicates high severity, but the EPSS score of 0.00638 (less than 1%) suggests the likelihood of exploitation is very low at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network based, requiring an attacker with authorized access to the SharePoint environment to supply the malicious payload. If such an attacker succeeds, they can execute code on the server with the permissions of the SharePoint process, potentially compromising the entire server and connected applications.