Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch

CISA has reported active exploitation of a Microsoft SharePoint deserialization vulnerability (CVE-2024-38094) that allows authenticated attackers with Site Owner permissions to inject and execute arbitrary code. Microsoft patched the issue (CVSS 7.2) and a public proof-of-concept exists; CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the fix and urging all organizations to prioritize remediation.