Merged summary · grok-4.7 · rewritten as coverage arrives
China-linked Warlock ransomware is still exploiting unpatched SharePoint at water, telecom, government, and university targets, Symantec says.
Symantec’s Threat Hunter Team says the Warlock ransomware operation, tracked as Longlegs and Microsoft’s Storm-2603 and described as China-linked or China-based, is still compromising unpatched on-premises SharePoint servers. Over roughly two months it hit at least four organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America: a water utility, a telecommunications provider, a regional government body, and a university. In one intrusion, attackers disabled security tools on at least 40 hosts and encrypted at least 33 after staging Warlock in SYSVOL; BleepingComputer places the intrusion on July 22 and encryption on July 31, while Security Affairs dates the start to 22 July 2026. The reported chain includes ToolShell-related SharePoint bugs, webshells, ASP.NET machine-key theft, DLL sideloading, Visual Studio Code tunnels, and the signed K7RKScan driver CVE-2025-1055. Sources disagree on the SharePoint identifiers: BleepingComputer names CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, SecurityWeek lists 2026 CVEs such as CVE-2026-32201, and The Record refers to 2025 ToolShell flaws plus newer 2026 bugs highlighted by CISA. The Hacker News adds the Gold Salem alias and Carbon Black as a source, while The Record says the operators previously used LockBit, Microsoft had not linked them to another tracked Chinese state group, and last year’s related campaign was alleged to have affected at least 400 organizations, including NNSA, NIH, and DHS.
Symantec’s Threat Hunter Team describes Warlock as China-linked or China-based and tracks it as Longlegs and Microsoft’s Storm-2603; The Hacker News also cites Carbon Black and the alias Gold Salem.
Over about two months the group hit at least four organizations in Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America: a water utility, a telecommunications provider, a regional government body, and a…
In one intrusion, defenses were disabled on at least 40 hosts and Warlock encrypted at least 33 via SYSVOL; BleepingComputer dates the intrusion to July 22 and encryption to July 31, while Security Affairs says it began 22 July 2026.
BleepingComputer names on-premises SharePoint ToolShell flaws CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771; SecurityWeek instead lists 2026 CVEs including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164,…
Follow-on activity included webshells, ASP.NET machine-key theft, DLL sideloading, Visual Studio Code tunnels, and a BYOVD tool abusing signed driver K7RKScan.sys (CVE-2025-1055); BleepingComputer also mentions NetExec.
A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
Authenticated Code Injection RCE in Microsoft SharePoint
The Record says the operators previously used LockBit, Microsoft had not tied them to another tracked Chinese state group, and last year’s related SharePoint campaign was alleged to have hit at least 400 organizations, including NNSA, NIH,…
A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged users to perform privileged actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical services or privileged applications.
Authenticated Code Injection RCE in Microsoft SharePoint
CVE-2025-49704 is a code injection vulnerability (CWE-94) in Microsoft SharePoint that allows an authorized (authenticated) attacker to execute arbitrary code on the server over the network, by sending requests whose attacker-controlled input SharePoint executes as code. It can be chained with CVE-2025-49706, and Microsoft subsequently issued CVE-2025-53770 as a patch bypass of the original CVE-2025-49704 fix, meaning the CVE-2025-53770 updates provide stronger protection and should be treated as the definitive remediation. Successful exploitation yields remote code execution on the SharePoint server, and CISA added the flaw to the KEV on 2025-07-22 with known ransomware use. Organizations running on-premises SharePoint Server are affected; CISA directs owners of public-facing servers running EOL/EOS versions (SharePoint Server 2013 and earlier) to disconnect them, and operators of supported versions to apply the CISA and vendor mitigations and updates, with cloud SharePoint services governed by BOD 22-01. Exploitation is confirmed in the wild and EPSS assigns a 100% probability of exploitation within 30 days (top percentile), although no public proof-of-concept code is documented.
Do: Apply Microsoft's SharePoint Server updates for CVE-2025-53770, which supersede the original CVE-2025-49704 fixes with more robust protection, prioritizing internet-facing servers. Disconnect public-facing SharePoint servers running EOL/EOS versions (SharePoint Server 2013 and earlier), and for supported versions follow the CISA and vendor mitigations, with cloud services handled per BOD 22-01. Because in-the-wild exploitation and ransomware use are confirmed, hunt for indicators of compromise and ransomware activity on exposed SharePoint servers.
8.8
group max
100%
KEV ransomware
Microsoft SharePoint CISA lists 'Microsoft SharePoint' without enumerating specific version ranges; the CISA KEV guidance targets on-premises SharePoint Server, calling out SharePoi
masstens of thousands of internet-exposed SharePoint servers per public scans, within a total on-premises install base plausibly exceeding 100,000 deployments…
Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days.
Do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation.
Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing
CVE-2025-53771 is an improper authentication flaw (CWE-287) in Microsoft's on-premises SharePoint Server that allows an unauthenticated remote attacker to conduct spoofing over the network. Per the CVSS vector, exploitation requires no privileges and no user interaction, so an attacker who can reach the SharePoint server over the network can trigger it directly. Successful exploitation lets the attacker impersonate an authenticated user or component, producing limited but real impact on confidentiality and integrity (CVSS 6.5, medium). Any organization running on-premises SharePoint Server is affected, particularly those exposing it to the internet; no specific version numbers are provided in the source data, so defenders should consult Microsoft's advisory for their edition. No public PoC exists and it is not yet in CISA's KEV, but exploitation likelihood is near-certain (EPSS 99.7%, 100th percentile), and Microsoft has confirmed active China-linked nation-state exploitation of the closely related SharePoint ToolShell vulnerability chain, which has hit roughly 400 organizations including U.S. federal agencies.
Do: Apply Microsoft's SharePoint Server security updates that ship this fix as soon as possible, prioritizing internet-facing servers, and treat this as urgent because it was patched alongside the actively exploited ToolShell chain. While patching, review authentication and web-server logs on SharePoint hosts for unexpected successful logons or anomalous requests that could indicate spoofing or compromise, and restrict network access to SharePoint (VPN, firewall rules, segmentation) if patching must be delayed.
Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
Microsoft SharePoint Server contains an improper input validation flaw (CWE-20) that can be triggered by an unauthenticated, network-based attacker submitting crafted input to the server. Successful exploitation allows the attacker to perform spoofing over the network, impersonating a trusted user or source within SharePoint; detailed impact mechanics have not been published and no CVSS score or public proof-of-concept is available. Any organization running on-premises Microsoft SharePoint Server is potentially affected, and the available data does not specify affected version ranges. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2026-04-14, indicating evidence of active exploitation, and EPSS assigns a 42.8% probability of exploitation within 30 days (99th percentile). Ransomware association is currently unknown.
Do: Apply Microsoft's security updates for SharePoint Server per the vendor advisory as soon as possible, and identify your SharePoint Server versions and builds since specific affected ranges are not provided here. Given the KEV listing, federal agencies must apply the vendor mitigations, follow applicable BOD 22-01 cloud guidance, or discontinue use by the established deadline. Until patched, limit network exposure of SharePoint servers and review authentication and access logs for signs of impersonation or spoofing activity.
Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server in which an authorized (authenticated, low-privilege) attacker can submit crafted serialized data over the network, with no user interaction required, to execute code on the server. Successful exploitation carries high impact on confidentiality, integrity, and availability within the SharePoint service context, giving attackers a foothold for follow-on activity, and CISA notes that ransomware use is known. Organizations running on-premises Microsoft SharePoint Server are affected; the source data lists no specific version ranges, and the CPE scope (sharepoint server) points to the on-premises product rather than the Microsoft-managed SharePoint Online service. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-01 after active exploitation, and its EPSS score of 76.1% (100th percentile) indicates a high probability of near-term exploitation. The CVE record lists no public proof-of-concept, though related reporting describes exploitation activity following a public PoC release for a SharePoint authentication bypass.
Do: Apply Microsoft's current security updates for SharePoint Server following vendor instructions, prioritizing internet-facing servers, and comply with CISA BOD 26-04, which requires applying mitigations per vendor guidance (including the cited Forensics Triage Requirements) or discontinuing use of the product if mitigations are unavailable. Because in-the-wild exploitation and ransomware use are confirmed, triage exposed servers for compromise: review IIS/SharePoint logs for unexpected authenticated requests, look for webshells or newly modified files in SharePoint web roots, and check for unusual child processes spawned by the SharePoint application pool. Given related reporting on an authentication-bypass PoC, also verify that any related SharePoint authentication-bypass patches are…
Unauthenticated Deserialization RCE in Microsoft SharePoint Server
CVE-2026-58644 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthorized attacker to execute code over a network. An attacker triggers it by sending crafted serialized data to the server, with no privileges or user interaction required, gaining code execution in the context of the SharePoint service. Any organization running on-premises SharePoint Server is affected, with highest risk for instances reachable from the internet or by untrusted network users. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-07-16, and contemporaneous headlines describe an exploited SharePoint zero-day, indicating active in-the-wild exploitation; EPSS assigns a roughly 16% probability of exploitation within 30 days (97th percentile). Fixes shipped in Microsoft's July 2026 Patch Tuesday release (621 CVEs total), while no public proof-of-concept for this specific CVE is documented.
Do: Apply Microsoft's July 2026 Patch Tuesday security updates for SharePoint Server immediately, prioritizing internet-facing instances, as required for federal agencies under CISA BOD 26-04 and the KEV listing. If patching must be delayed, restrict network exposure to SharePoint per Microsoft/CISA mitigation guidance and assess each asset's internet exposure. Review SharePoint and web-server logs for signs of exploitation and enumerate all SharePoint Server installations in the environment to confirm coverage.
Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation
Microsoft SharePoint Server contains a missing authentication for critical function vulnerability (CWE-306) that lets an unauthenticated attacker elevate privileges over a network without valid credentials. The flaw is triggered when the affected SharePoint function is accessed remotely without any authentication check, allowing an attacker to gain higher privileges than intended. Successful exploitation could enable an attacker to take elevated actions within the SharePoint environment, potentially leading to further compromise of the server and its data. All organizations running on-premises Microsoft SharePoint Server are potentially affected, though specific versions have not yet been enumerated by Microsoft or CISA. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, indicating it is being actively exploited, and its EPSS score of 26.6% (98th percentile) reflects a high near-term exploitation risk.
Do: Apply Microsoft's security updates for SharePoint Server as soon as they are available, and check Microsoft's advisory for the specific affected version ranges once published. In the meantime, restrict network access to SharePoint servers, especially for internet-facing instances, and verify whether your environment falls under CISA BOD 26-04 requirements given the KEV listing. Monitor for updated guidance from Microsoft and CISA, as exploitation is confirmed and patching urgency is high.
9.8
1%
KEV
Microsoft SharePoint Server
Microsoft SharePoint Server (on-premises) Specific version ranges not enumerated in the source data; Microsoft SharePoint on-premises is affected. CISA notes SharePoint Server 2013 and earlier are EOL/E
mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users
KEV
large
Tens of thousands of internet-facing SharePoint Server deployments, with a total on-prem installed base plausibly in the hundreds of thousands (estimate)
mass
likely on the order of 100,000+ on-premises SharePoint Server installations, of which tens of thousands are directly internet-exposed
KEV
KEV
ransomware
Microsoft SharePoint Server
mass≈100,000 internet-exposed SharePoint Server deployments (order-of-magnitude estimate), with total users across on-premises deployments likely in the millions
KEV
KEV
Microsoft SharePoint Server (on-premises)
masson the order of 100,000+ on-prem SharePoint Server deployments, with tens of thousands likely internet-exposed (estimate)
KEV
mass
potentially millions of users and well over 100,000 exposed installations worldwide
SecurityWeek· 80
The Record· 78
BleepingComputer· 78