A vulnerability in on-premises SharePoint Server allows code execution by an attacker with valid credentials (username and password) and ordinary site-member rights. It's not theory - it's already being used in real attacks. That's why CISA added it to the catalog of actively exploited holes and set a patching deadline for federal agencies.
Fact
The facts: SharePoint Server 2016, 2019 and Subscription Edition (on-premises installs, not cloud SharePoint Online) are affected. Valid credentials and site-member rights are needed, which is a low bar for an insider attacker or a stolen account. Microsoft initially rated the risk as low; reality proved it wrong.
I'll allow myself an opinion here: what matters is the gap between the vendor's assessment and what attackers actually do. 'Unlikely to be exploited' doesn't mean safe. It just means no one has tried it publicly yet. If CISA sets a deadline, someone has already tried it successfully.
Running on-premises SharePoint? Stop reading. Act. The patch is available, the clock is running. Cloud installs are off the hook, but the forgotten on-premises server is exactly the classic open door.
Official primary sources
CISA - Known Exploited VulnerabilitiesThe visual is generated code-art, no third-party images.