Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
ToolShell: Details of CVEs affecting SharePoint servers
60
60
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers
60
ToolShell Exploit: Critical SharePoint Zero
60
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
60
60
60
Storm-2603 spotted deploying ransomware on exploited SharePoint servers
60
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026
60
60
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
60
Microsoft issues emergency patches for SharePoint zero
60
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).
78
U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog
60
60
60
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
60
60
2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.
90
60
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
60
Microsoft Issues Patches For Severe Flaws, Including Office Zero
60
60
SharePoint vulnerability with 9.8 severity rating under exploit across globe
60
60
60
60
Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
60
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
60
60
60
60
60
60
Microsoft Patches Record 622 Flaws, Including Two Zero
60
60
Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.
84