Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
ToolShell: Details of CVEs affecting SharePoint servers
60
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers
60
ToolShell Exploit: Critical SharePoint Zero
60
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
60
60
60
Storm-2603 spotted deploying ransomware on exploited SharePoint servers
60
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026
60
60
Microsoft issues emergency patches for SharePoint zero
60
U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog
60
60
60
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
60
60
2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.
90
60
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
Microsoft Issues Patches For Severe Flaws, Including Office Zero
60
60
SharePoint vulnerability with 9.8 severity rating under exploit across globe
60
60
60
60
Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
60
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
60
60
60
60
60
Microsoft Patches Record 622 Flaws, Including Two Zero
60
60
Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.
84
No Critical CVEs Addressed in February Patch Tuesday
60
60
60
AI-driven bug hunting fuels record Microsoft Patch Tuesday
60
CISA Orders Urgent Patching After Chinese Hackers Exploit SharePoint Flaws in Live Attacks
60