60
60
60
60
60
60
60
60
Network Security Trends: August
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
60
60
60
60
60
60
60
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.
Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
78
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
60
60
60
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.
86
Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.
84
60
60
60
60
60
60
Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
60
60
60
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks
60
60
CISA adds Sophos firewall bug to Known Exploited Vulnerabilities Catalog
60
U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog
60
60
60