CVE-2021-26420: Microsoft SharePoint WorkflowCompilerInternal Exposed Dangerous Function Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint. Authentication is required to exploit this vulnerability. The specific flaw exists within the System.Workflow.ComponentModel.Compiler.WorkflowCompilerInternal class. This class allows an attacker to specify a path to an arbitrary workflow definition file. An attacker can leverage this vulnerability to execute code in the context of the web service account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-26420?
CVE-2021-26420 is a vulnerability in Microsoft SharePoint that allows remote attackers to execute arbitrary code on affected installations.
What is the severity of CVE-2021-26420?
The severity of CVE-2021-26420 is high, with a CVSS score of 7.5.
Which versions of Microsoft SharePoint are affected by CVE-2021-26420?
CVE-2021-26420 affects Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Foundation 2013 SP1, and Microsoft SharePoint Server 2019.
How can I fix CVE-2021-26420 in Microsoft SharePoint Enterprise Server 2016?
To fix CVE-2021-26420 in Microsoft SharePoint Enterprise Server 2016, you can apply the patch provided by Microsoft or follow the remediation steps mentioned in the Microsoft knowledge base article.
Where can I find more information about CVE-2021-26420?
You can find more information about CVE-2021-26420 on the Microsoft Security Response Center website and the Zero Day Initiative advisory.