High

Replay-based RCE in Microsoft SharePoint Server

IdentifiersCVE-2021-27076CWE-294

CVE-2021-27076 is a Microsoft SharePoint Server remote code execution vulnerability described in the provided content as a replay-style attack against SharePoint. The supporting material explicitly frames the issue as an example of a replay attack, where legitimately authenticated data can be reused in a different context. The content does not provide a full vendor-level root-cause analysis for CVE-2021-27076 itself, but it does state that later SharePoint deserialization research reused the same method developed for CVE-2021-27076 to store binary session data and replay it later. Based on the supplied material, the vulnerability affects SharePoint services exposed via IIS and can be leveraged to compromise the SharePoint server and then deploy follow-on payloads such as web shells and DLL sideloading chains.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to remote code execution on the SharePoint server. The provided content shows the vulnerability being used as an initial access vector against internet-facing SharePoint instances, after which attackers established persistence with web shells and used a DLL sideloading chain involving SystemSettings.exe/SystemSettings.dll to deliver SharkLoader or Cobalt Strike. In practical terms, exploitation can give an attacker server compromise, arbitrary payload execution, persistence, post-exploitation reconnaissance, credential theft, and a foothold for broader lateral movement.

Mitigation

If you can’t patch tonight, do this now.

The supplied content does not provide official mitigation guidance specific to CVE-2021-27076. Available mitigations from the context are limited to reducing exposure of internet-facing SharePoint services, monitoring IIS/SharePoint servers for exploitation and post-exploitation artifacts, and hunting for persistence mechanisms such as web shells, registry Run keys, and scheduled tasks. Detection of anomalous DLL sideloading involving SystemSettings.exe and suspicious outbound DNS/C2 activity is also relevant based on the observed intrusions.

Remediation

Patch, then assume compromise.

The specific remediation details are not provided in the supplied content. Based on the content, the appropriate remediation is to apply Microsoft's security update for CVE-2021-27076 to affected SharePoint Server deployments and verify that all internet-facing SharePoint systems are fully patched. Because the vulnerability has been exploited in the wild, responders should also review SharePoint and IIS hosts for signs of compromise, including unexpected web shells, suspicious scheduled tasks, and files such as SystemSettings.exe/SystemSettings.dll placed outside normal Windows locations.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationBusiness Productivity Serversapplication

Microsoft CorporationSharepoint Foundationapplication

Microsoft CorporationSharepoint Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

the hacker newsNews

Jun 26, 2026

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A Microsoft SharePoint vulnerability weaponized by the threat actor and specifically tied to a DLL side-loading persistence chain delivering SharkLoader.

malware newsNews

Jun 24, 2026

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - Malware News - Malware Analysis, News and Indicators

A Microsoft SharePoint vulnerability exploited in the campaign and specifically referenced in a later intrusion example.

securelistNews

Oct 6, 2025

How a machine-learning model in Kaspersky SIEM detected DLL-hijacking incidents | Securelist

A SharePoint vulnerability leveraged to compromise a SharePoint service running on IIS, after which attackers deployed files and used DLL sideloading for execution/persistence (including a Cobalt Strike implant).

starlabs sgNews

May 12, 2022

New Wine in Old Bottle - Microsoft Sharepoint Post-Auth Deserialization RCE (CVE-2022-29108) | STAR Labs

A SharePoint replay-style deserialization vulnerability referenced as using the same session-data storage and reuse technique as the vulnerabilities discussed in the article.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware6

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2021-27076

NVD

nvd.nist.gov/vuln/detail/CVE-2021-27076

MITRE CWE · CWE-294

cwe.mitre.org

Patch

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076

Third Party Advisory

zerodayinitiative.com/advisories/ZDI-21-276