Search: “SharePoint Server 2019”

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 19:42 UTC · 8d agoVulnerability 3 sourcesCVE-2026-505221

CVE-2026-50522: Patch Critical SharePoint RCE Now

Microsoft patched CVE-2026-50522 (CVSS 9.8), an unauthenticated deserialization RCE in on-premises SharePoint servers, in its July 2026 updates; no exploitation confirmed at disclosure.

CVE-2026-50522 is a critical (CVSS 9.8) deserialization of untrusted data flaw (CWE-502) allowing unauthenticated remote code execution on on-premises Microsoft SharePoint servers. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, with fixes shipped in Microsoft's July 14, 2026 security updates; SharePoint Online is not listed as affected. No public evidence of active exploitation of this specific CVE existed at disclosure, though CISA's SSVC judged the attack automatable with total technical impact.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 09:32 UTC · 8d agoVulnerabilityCVE-2026-50522

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.

CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).

The Hacker News·Aug 12, 13:46 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-45659CVE-2025-113711

September Windows Server updates break Remote Desktop Services

September 2026 Windows Server cumulative updates cause Remote Desktop Services failures on Server 2019, 2022 and 2025, forcing some admins to roll back.

Admins report Remote Desktop Services failures after installing September 2026 Patch Tuesday updates KB5122876 (Server 2019), KB5122882 (Server 2022), and KB5122871 (Server 2025), with connections hanging, sessions failing after logout, and some systems requiring hard resets. One administrator debugging Server 2022 observed an apparent deadlock between RDP and the Local Session Manager, though Microsoft has not confirmed a root cause. Rolling back the updates restores RDS functionality but removes this month's security fixes. Microsoft had not responded to inquiries at publication time.

BleepingComputer·updated 16:06 UTC · 34m ago·first Sep 10, 20:34 UTC · 5d agoVulnerability 24 sources1

Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.

Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.

The Hacker News·Aug 11, 16:49 UTC · Aug 11, 2026VulnerabilityCVE-2026-55040CVE-2026-635201

SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit

Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.

CVE-2026-55040 is a critical authentication bypass (CVSS 9.1) in SharePoint Server Subscription Edition that lets unauthenticated attackers forge JWT tokens and impersonate any user, including administrators. Microsoft patched it in July 2026 Patch Tuesday, but Rapid7 published a technical write-up and Python PoC on GitHub on August 12, and Defused quickly observed attackers running the PoC against SharePoint honeypots. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S. Admin-level SharePoint access exposes documents and data modification and can serve as a foothold into broader Microsoft 365 infrastructure; unpatched instances should apply the July update immediately.

Security Affairs·Aug 13, 08:36 UTC · Aug 13, 2026Exploit / PoC in the wildCVE-2026-55040

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber Security·Sep 8, 19:03 UTC · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-858801

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.

Rapid7 Labs' zero-day research project on Microsoft SharePoint uncovered two vulnerabilities that, when chained, achieve unauthenticated remote code execution. The second flaw in the chain, CVE-2026-63520, affects all supported versions of Microsoft SharePoint and has been disclosed and fixed. The first chain component, CVE-2026-55040, was disclosed by Rapid7 and Microsoft the previous month.

Rapid7 Blog·Aug 11, 13:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-63520CVE-2026-550401

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress·Sep 8, 04:00 UTC · 8d agoResearch1

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7's analysis of SharePoint auth bypass CVE-2026-55040 includes a PoC for unauthenticated admin-level operations.

Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass in Microsoft SharePoint, on July 14, 2026. The flaw stems from multiple issues in SharePoint's JWT token validation pipeline, allowing a remote unauthenticated attacker to bypass authentication and perform operations as a site user or administrator. Rapid7 has now published a technical analysis and a proof-of-concept script, based on SharePoint Server Subscription Edition.

Rapid7 Blog·Aug 11, 13:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-550401

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.

Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.

Help Net Security·Sep 9, 09:04 UTC · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+4 CVEs

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 published technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint.

Rapid7 released an analysis covering CVE-2026-63520, a remote code execution flaw affecting Microsoft SharePoint. SharePoint is widely deployed in enterprise environments, making exposed, unpatched servers a likely target for exploitation. Defenders should consult the Rapid7 write-up for exposure checks and patch guidance. The available text does not confirm active exploitation at this time.

Rapid7 Blog·Aug 24, 16:18 UTC · 23d agoVulnerabilityCVE-2026-635201

Patch Tuesday - September 2026

Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.

Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.

Rapid7 Blog·Sep 8, 21:44 UTC · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-85046+10 CVEs

Top 10 Best Server Security Solutions in 2026

Cyber Security News ranks 2026 server security platforms, favoring Trend Micro for hybrid estates, CrowdStrike for detection, Defender for Azure economics.

Cyber Security News published an editorial ranking of ten server security platforms for 2026, favoring Trend Micro for hybrid estates, CrowdStrike for detection quality, and Microsoft Defender for Servers for Azure-centric economics. The guide stresses that server security licensing differs (per server, per core, or per cloud-hour) and flags hypervisor protection as a commonly missed coverage gap.

Cyber Security News·Sep 10, 08:23 UTC · 6d agoIndustry1

September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)

Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.

Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.

SANS Internet Storm Center·Sep 8, 19:20 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-66302+5 CVEs1

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News·Sep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net Security·Aug 25, 06:52 UTC · 22d agoIndustry in the wildCVE-2026-505221

Windows Server 2022 reaches end of mainstream support next month

Microsoft says Windows Server 2022 ends mainstream support on October 13, 2026, entering extended security updates through October 14, 2031.

Windows Server 2022, the September 2021 Long-Term Servicing Channel release, will receive its last mainstream support update with the October 2026 security patch. After October 13, 2026, it transitions to extended support with free monthly security updates through October 14, 2031. Microsoft also extended hotpatching for Datacenter: Azure Edition until October 2027 and recommends upgrading to Windows Server 2025, the current LTSC release.

BleepingComputer·09:10 UTC · 7h agoIndustry

12 Best Server Security Solutions Compared (2026): Features & Pricing

GBHackers ranks 12 server security solutions for 2026, naming CrowdStrike and SentinelOne as server EDR leaders and Trend Micro Deep Security top for virtual patching.

The guide scores 12 server security platforms across five weighted criteria, with detection and response depth and Linux parity weighted 25% each. CrowdStrike and SentinelOne lead server EDR, Trend Micro Deep Security is highlighted for virtual patching of unpatchable estates, and Microsoft Defender for Servers is noted for Azure and hybrid economics. It is an editorial assessment comparing features and pricing models rather than a lab test.

GBHackers·updated 09:52 UTC · 6h ago·first Sep 11, 07:24 UTC · 5d agoIndustry 13 sources1

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)

Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.

Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026Exploit / PoC in the wildCVE-2026-55040CVE-2026-63520

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.

CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.

The Hacker News·Aug 19, 15:26 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400CVE-2026-55040CVE-2026-59310+1 CVEs

September 2026 Patch Tuesday forecast: All we need is more time

September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.

This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.

Help Net Security·Sep 9, 09:05 UTC · 7d agoAdvisory in the wildCVE-2026-55040CVE-2026-63520CVE-2026-62911+5 CVEs1

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.

Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-55040CVE-2026-45659CVE-2026-56164+2 CVEs

U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog

CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.

Security Affairs·Aug 19, 07:19 UTC · 28d agoExploit / PoC in the wildCVE-2026-33824CVE-2026-55040CVE-2026-59310+1 CVEs

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabz·Sep 3, 20:19 UTC · 12d agoVulnerabilityCVE-2026-629112

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.

Ontinue's Cyber Defense Center identified TWINLOOT during a July 2026 campaign investigation: a modular, PyArmor-hardened Python implant (a 39 MB bootstrap-fat.pyc loader) whose entire C2 infrastructure lives inside trusted Microsoft services. Tasking flows through SharePoint Online file dead drops polled every 15 seconds via the Microsoft Graph API, while interactive operator access uses WebRTC DataChannels relayed by Microsoft Teams TURN servers; Graph traffic is driven by the victim's own headless Edge browser. The implant harvests Windows credentials with fake lock screens, offers a reverse SOCKS5 pivot for lateral movement to SMB, RDP, WinRM, and MSSQL, executes commands, and persists on hosts. Initial access is assessed to be Teams social engineering masquerading as IT support, prompting a PowerShell command to download the payload.

The Hacker News·Aug 18, 15:17 UTC · 29d agoMalware

Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate

Proofpoint's 2026 survey of 1,600 CISOs finds improving cyber resilience, rising human risk, and expanding AI responsibilities without added resources.

Proofpoint released its 2026 Voice of the CISO report, a Censuswide-conducted survey of 1,600 CISOs across 16 countries fielded in May 2026. Expected material cyberattacks fell from 76% to 61% year over year and material data loss declined from 66% to 53%, but 79% of CISOs now identify human risk as their biggest vulnerability and GenAI security concerns jumped 18 points to 78%. The report also finds 79% of CISOs expect to manage AI-related risks without proportional resources, and 85% say boards are evaluating cyber risk through a commercial lens.

Proofpoint Threat Insight·Sep 9, 02:03 UTC · 7d agoIndustry

6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs

ANY.RUN's H1 2026 report details 15 threat trends including 437% growth in fake CAPTCHA phishing and 90.7% rise in Adobe infrastructure abuse.

The report draws on interactive sandbox submissions from over 700,000 analysts and 16,000 SOC teams between January and June 2026. Attacks abusing Adobe infrastructure grew 90.7% versus H2 2025 while RMM-related attacks rose 26.5%, and custom fake CAPTCHA phishing grew 437% from Q1 to Q2 2026. ANY.RUN argues static IOCs are losing effectiveness as dead drop resolvers hide the final C2 until execution.

ANY.RUN·Sep 15, 09:05 UTC · 1d agoResearch

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net Security·Sep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-62911CVE-2026-42897

ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92203, CVSS 7.7) in Airbyte's SharePoint connector, exploitable by authenticated remote users.

The Zero Day Initiative published ZDI-26-703 describing a server-side request forgery vulnerability in the _get_shared_drive_object function of Airbyte's SharePoint connector. Remote attackers can initiate arbitrary server-side requests to disclose information, though valid authentication credentials are required. The flaw carries a CVSS score of 7.7 and is tracked as CVE-2026-92203; it is flagged as a 0day with no vendor patch referenced.

ZDI Published Advisories·05:00 UTC · 11h agoVulnerability 2 sourcesCVE-2026-92203

200 accounts compromised in Swiss government's Microsoft SharePoint breach

Help Net Security·Aug 7, 00:00 UTC · Aug 7, 2026Vulnerability in the wildCVE-2026-56164CVE-2026-50522

SharePoint Flaws Used to Hack Switzerland's Federal IT Agency

Security Affairs·Aug 4, 20:16 UTC · Aug 4, 2026Ransomware in the wildCVE-2026-505221