60
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
60
2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.
90
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026
60
60
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
60
60
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers
60
Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
60
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).
78
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
60
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
60
Microsoft Patch Tuesday for January 2023 fixed actively exploited zero
60
ToolShell: Details of CVEs affecting SharePoint servers
60
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
60
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
60
Microsoft issues emergency patches for SharePoint zero
60
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
60
Microsoft Patch Tuesday for June 2025 — Snort rules and prominent vulnerabilities
60
60
ToolShell Exploit: Critical SharePoint Zero
60
Microsoft Issues Patches for SharePoint Zero
60
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
60
Microsoft Issues Patches For Severe Flaws, Including Office Zero
60
60
U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog
60
July 2026 CVE Landscape
60
Update Your Windows Computers to Patch 6 New In-the-Wild Zero
60
60
60
60
60
60
Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
65
60
60