CVE-2021-27076Sharepoint Server Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Published Mar 12, 2021 · Updated Aug 19, 2026
Key Facts
Patch immediately- CVE-2021-27076 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Business Productivity Servers (Microsoft), Sharepoint Foundation (Microsoft), Sharepoint Foundation 2013 (Microsoft) and 6 more products.
- It is exploited in the wild, listed in Industry KEV feed since Jun 24, 2026. No public exploit code is known.
- EPSS estimates a 20% probability of exploitation in the next 30 days.
- Fixed versions are available, including Business Productivity Servers 14.0.7267.5000, Business Productivity Servers publication, Microsoft Business Productivity Servers 2010 Service Pack 2 14.0.7267.5000.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
20%
Higher than 97.4% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
53/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Jun 24, 2026
1930 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
3
Reports of active use
Advisories And Exploit References
Description
Microsoft SharePoint Server Remote Code Execution Vulnerability
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jun 24, 2026 | n/a | Not reported |
Affected Products
12 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Business Productivity ServersMicrosoft | 2010-sp2 | publication |
| Sharepoint FoundationMicrosoft | 2013-sp1 | publication |
| Sharepoint Foundation 2013Microsoft | See advisory | 15.0.5327.1000 |
| Sharepoint ServerMicrosoft | 2016, 2019 | publication |
| Sharepoint Server 2016Microsoft | See advisory | 16.0.5134.1000 |
Patched Releases
Business Productivity Servers
14.0.7267.5000, publication
Microsoft Business Productivity Servers 2010 Service Pack 2
14.0.7267.5000
Microsoft SharePoint Enterprise Server 2016
16.0.5134.1000
Sharepoint Foundation
publication
Sharepoint Foundation 2013
15.0.5327.1000
Microsoft SharePoint Foundation 2013 Service Pack 1
15.0.5327.1000
Sharepoint Server
publication
Sharepoint Server 2016
16.0.5134.1000
Sharepoint Server 2019
16.0.10372.20000
Timeline
Publicly disclosed
Mar 12, 2021
Added to Industry KEV feed
Jun 24, 2026
Last updated
Aug 19, 2026
References
- advisoryweb.nvd.nist.gov · vuln
- advisorycybersecurity-help.cz · SB2021030919
- advisorycybersecurity-help.cz · SB2021030955
- advisoryUSOM advisory
- advisoryUSOM advisory
FAQ
Common Questions.
Microsoft SharePoint Server Remote Code Execution Vulnerability
Affected: Business Productivity Servers (Microsoft) versions 2010-sp2; Sharepoint Foundation (Microsoft) versions 2013-sp1; Sharepoint Foundation 2013 (Microsoft), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jun 24, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Business Productivity Servers 14.0.7267.5000, Business Productivity Servers publication, Microsoft Business Productivity Servers 2010 Service Pack 2 14.0.7267.5000.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2021-27076 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo