Multiple remote code execution vulnerabilities disclosed in Microsoft SharePoint Server…
Multiple remote code execution vulnerabilities disclosed in Microsoft SharePoint Server versions and azl3 gnutls library.
The French CERT (ANSSI) has published an advisory regarding multiple vulnerabilities affecting Microsoft SharePoint Server products and the azl3 gnutls library. The vulnerabilities enable remote arbitrary code execution and an additional unspecified security issue as per the vendor.
Affected products include azl3 gnutls versions prior to 3.8.3-11, Microsoft SharePoint Enterprise Server 2016 (prior to 16.0.5552.1002), SharePoint Server 2019 (prior to 16.0.10417.20128), and SharePoint Server Subscription Edition (prior to 16.0.19725.20280). Two CVE identifiers are associated with this advisory: CVE-2026-42009 and CVE-2026-47294.
Organizations running affected versions should consult Microsoft's security bulletins and apply available patches immediately. The presence of remote code execution capabilities makes these vulnerabilities critical attack vectors for initial access.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by SharePoint IIS Worker Process
Detects cmd.exe, powershell.exe, or other command interpreters spawned by the SharePoint w3wp.exe worker process, a common post-exploitation behaviour following successful remote code execution against SharePoint Server vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by SharePoint IIS Worker Process
id: a7967cde-f888-5b20-b702-eae634a6e4e1
status: experimental
description: 'Detects command interpreters or scripting engines spawned as children
of the SharePoint
application pool worker process (w3wp.exe). This behaviour is commonly observed
following
successful exploitation of SharePoint Server remote code execution vulnerabilities
such as
those disclosed by ANSSI affecting SharePoint 2016/2019/Subscription Edition.
'
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: SharePoint
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \certutil.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate SharePoint administration scripts or scheduled maintenance tasks that
invoke PowerShell from the application pool
- Third-party SharePoint add-ins or monitoring agents that spawn helper processes
from w3wp.exe
level: high
tags:
- attack.t1190
- attack.execution
- attack.t1059
author: Vorant
SharePoint Worker Process Writing Executable or Script Files to Web Directories
Detects w3wp.exe (SharePoint application pool) writing new executable, script, or ASPX files to web-accessible directories, indicative of webshell drop following RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SharePoint Worker Process Writing Executable or Script Files to Web Directories
id: 57db2c20-cd8f-547d-9669-4542adb96691
status: experimental
description: 'Detects the SharePoint application pool worker process (w3wp.exe) creating
new script or
executable files, particularly ASPX files, in web-accessible directories. This pattern
is
consistent with webshell deployment following successful exploitation of SharePoint
Server
remote code execution vulnerabilities.
'
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith:
- .aspx
- .asmx
- .ashx
- .exe
- .dll
- .ps1
filter:
TargetFilename|contains:
- \Temp\
- \LOGS\
condition: selection and not filter
falsepositives:
- Legitimate SharePoint solution deployment or feature activation writing ASPX pages
or assemblies
- Administrator-driven custom web part or workflow deployment
level: medium
tags:
- attack.t1505.003
- attack.persistence
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0681
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free