Microsoft SharePoint Server and GnuTLS remote code execution flaws
Multiple remote code execution vulnerabilities disclosed in Microsoft SharePoint Server versions and azl3 gnutls library.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT (ANSSI) has published an advisory regarding multiple vulnerabilities affecting Microsoft SharePoint Server products and the azl3 gnutls library. The vulnerabilities enable remote arbitrary code execution and an additional unspecified security issue as per the vendor.
Affected products include azl3 gnutls versions prior to 3.8.3-11, Microsoft SharePoint Enterprise Server 2016 (prior to 16.0.5552.1002), SharePoint Server 2019 (prior to 16.0.10417.20128), and SharePoint Server Subscription Edition (prior to 16.0.19725.20280). Two CVE identifiers are associated with this advisory: CVE-2026-42009 and CVE-2026-47294.
Organizations running affected versions should consult Microsoft's security bulletins and apply available patches immediately. The presence of remote code execution capabilities makes these vulnerabilities critical attack vectors for initial access.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by SharePoint IIS Worker Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects cmd.exe, powershell.exe, or other command interpreters spawned by the SharePoint w3wp.exe worker process, a common post-exploitation behaviour following successful remote code execution against SharePoint Server vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by SharePoint IIS Worker Process
id: a7967cde-f888-5b20-b702-eae634a6e4e1
status: experimental
description: 'Detects command interpreters or scripting engines spawned as children
of the SharePoint
application pool worker process (w3wp.exe). This behaviour is commonly observed
following
successful exploitation of SharePoint Server remote code execution vulnerabilities
such as
those disclosed by ANSSI affecting SharePoint 2016/2019/Subscription Edition.
'
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: SharePoint
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \certutil.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate SharePoint administration scripts or scheduled maintenance tasks that
invoke PowerShell from the application pool
- Third-party SharePoint add-ins or monitoring agents that spawn helper processes
from w3wp.exe
level: high
tags:
- attack.t1190
- attack.execution
- attack.t1059
author: Vorant
SharePoint Worker Process Writing Executable or Script Files to Web Directories
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe (SharePoint application pool) writing new executable, script, or ASPX files to web-accessible directories, indicative of webshell drop following RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SharePoint Worker Process Writing Executable or Script Files to Web Directories
id: 57db2c20-cd8f-547d-9669-4542adb96691
status: experimental
description: 'Detects the SharePoint application pool worker process (w3wp.exe) creating
new script or
executable files, particularly ASPX files, in web-accessible directories. This pattern
is
consistent with webshell deployment following successful exploitation of SharePoint
Server
remote code execution vulnerabilities.
'
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith:
- .aspx
- .asmx
- .ashx
- .exe
- .dll
- .ps1
filter:
TargetFilename|contains:
- \Temp\
- \LOGS\
condition: selection and not filter
falsepositives:
- Legitimate SharePoint solution deployment or feature activation writing ASPX pages
or assemblies
- Administrator-driven custom web part or workflow deployment
level: medium
tags:
- attack.t1505.003
- attack.persistence
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0681
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs