Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers
60
55
Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)
60
60
60
60
SharePoint vulnerability with 9.8 severity rating under exploit across globe
60
57
30
30
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.
Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.
74
Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
60
30
ToolShell Exploit: Critical SharePoint Zero
60
30
57
30
60
60
30
30
55
30
30
55
55
30
30
30
60
55
42
55
60
60
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
60
60
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.
CloudSEK researchers gained administrator access to the BigBear 2.0 phishing-as-a-service control panel and found it had exfiltrated 5,137 credential records, including 474 completed MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 3,331 victim IPs in 40+ countries. The Evilginx2-based AitM proxy intercepts credentials and authenticated session cookies, and custom JavaScript interferes with FIDO2/WebAuthn to force weaker authentication. The panel is leased to at least five affiliate operators via Telegram exfiltration bots, and geo-matched residential proxies cover 69 countries to evade detection.
72