SERVER-WEBAPP Microsoft SharePoint Server remote code execution attempt

IPS-NPA

13 SIDs: 58314, 58315, 58316, 58317, 58318, 58319, 62026, 62027, 64474, 64537, 64757, 64761, 65107

Description

Detects an attempt to exploit CVE-2021-40487, CVE-2025-21400, CVE-2025-29794, and 4 others, a remote code execution flaw that can run code on the server in Microsoft SharePoint Server.

CVEs

CVE-2021-40487 CVE-2025-21400 CVE-2025-29794 CVE-2023-33134 CVE-2023-33160 CVE-2025-29793 CVE-2025-49701

Related malware families

Microsoft

References

msrc.microsoft.com
msrc.microsoft.com
portal.msrc.microsoft.com
portal.msrc.microsoft.com
msrc.microsoft.com
msrc.microsoft.com
msrc.microsoft.com