SharePoint, On Premises

Its Layers

You run every layer, so you patch SharePoint, ASP.NET, IIS, .NET, SQL Server and Windows yourself.

The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.

Who Runs What

You run every layer, from SharePoint down to Windows Server and the machines beneath it. Microsoft writes the updates, but none of them protects the farm until your team installs it.

You

Your team runs it and installs its updates.

Where Its Code Comes From

Nearly all of its code arrives in Microsoft's updates, for SharePoint, SQL Server and Windows alike. Custom solutions built for the farm add packages from NuGet, which your developers choose and keep up to date.

• Vendor Updates
• NuGet

Well-Known Flaws in Its Layers

These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.

• CVE-2025-53770 (opens in a new tab)2025

  ToolShell, in SharePoint

  An unauthenticated attacker could run code on an on-premises SharePoint server.

• CVE-2020-1472 (opens in a new tab)2020

  Zerologon, in Windows Server

  A Netlogon flaw let an attacker with no credentials reset a domain controller's password.

• CVE-2017-0144 (opens in a new tab)2017

  EternalBlue, in Windows Server

  A flaw in SMBv1 allowed remote code execution on unpatched Windows machines.

Sources

• Microsoft Learn: shared responsibility in the cloud (opens in a new tab)