#sharepoint
-
Warlock Keeps Exploiting SharePoint Flaws to Hit Critical Infrastructure
The suspected China-linked Warlock group continues to weaponize Microsoft SharePoint vulnerabilities, disable security tools, and deploy ransomware. Its recent victims span Portuguese- and Spanish-speaking countries.
-
CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited
CISA added two vulnerabilities — in Microsoft SharePoint and MikroTik RouterOS — to its KEV catalog, citing evidence of active exploitation. One RouterOS flaw is part of the MikroTrick chain that hijacks routers without a password.
-
Attacks on SharePoint: Public PoC Fuels Exploitation of an Authentication Bypass
After Rapid7 published a proof-of-concept exploit, attackers began actively exploiting the critical CVE-2026-55040 vulnerability in Microsoft SharePoint, which allows a JWT to be forged and lets an attacker impersonate any user.
-
Rapid7 uncovers a SharePoint exploit chain with an AI agent
Rapid7 researchers chained an authentication bypass and a remote code execution vulnerability in Microsoft SharePoint to gain access with no account at all. Much of the work was done by an AI agent — which, the company admits, “cheated.”
-
CISA: SharePoint Vulnerability Being Used in Ransomware Attacks
The US agency CISA has confirmed that ransomware groups have begun exploiting a serious remote code execution vulnerability in Microsoft SharePoint. Active attacks have been observed since early July.
-
Critical SharePoint Vulnerability CVE-2026-50522 Exploited After PoC Release
The third SharePoint Server vulnerability from Microsoft's July patch batch has come under active exploitation: attackers are stealing servers' machine keys to gain persistence in the system.
-
CISA Warns of Active Exploitation of SharePoint Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that attackers are actively exploiting three vulnerabilities to breach internet-facing on-premises SharePoint servers. Administrators are advised to install updates without delay.