CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities

A remote code execution vulnerability in Microsoft SharePoint, CVE-2026-65660, is now being exploited in attacks, approximately six weeks after Microsoft released patches. The flaw allows an authenticated attacker with low-level access to execute arbitrary code without user interaction. This exploitation prompted CISA to add the vulnerability to its KEV catalog, requiring federal agencies to patch by September 28.

CISA has added two vulnerabilities, CVE-2026-65660 in Microsoft SharePoint and CVE-2026-67279 in MikroTik RouterOS, to its Known Exploited Vulnerabilities catalog. Both flaws are being actively exploited in the wild, posing significant risks to affected organizations.

CISA has issued a warning about active exploitation of critical vulnerabilities in WSO2 products and Adobe Commerce, alongside high-severity flaws in Microsoft SharePoint and Mikrotik RouterOS. Federal agencies must apply updates for the critical issues by September 27, as these vulnerabilities could lead to administrative account compromise and unauthorized access.

A SharePoint Server vulnerability, CVE-2026-65660, initially classified by Microsoft as a spoofing flaw, has been re-evaluated by a security researcher as an authenticated remote code execution (RCE) vulnerability. This reclassification significantly increases the severity of the flaw, affecting SharePoint Server 2016, 2019, and Subscription Edition, and highlights a discrepancy in Microsoft's initial assessment.

Microsoft's latest Patch Tuesday release addressed 973 vulnerabilities, a new record, with the CISA confirming that two of these, CVE-2026-81963 and CVE-2026-85880, are currently being exploited. Federal agencies must patch these exploited vulnerabilities by September 22. This large volume of disclosed bugs, exceeding 2,600 for the year, raises concerns about the increasing attack surface and the potential for chained exploits.

Microsoft released a record 974 patches for its products, addressing two zero-day vulnerabilities actively exploited in the wild. These patches are critical for system security, as the zero-days allowed local privilege escalation.

Approximately 22,000 Microsoft Exchange servers exposed online are still unpatched against a high-severity authentication bypass vulnerability, CVE-2026-62911, which allows attackers to hijack user mailboxes. This vulnerability affects Exchange Server 2016, 2019, and Subscription Edition, posing a significant risk to organizations that have not applied the August 2026 Patch Tuesday updates.

Threat actors are actively targeting a chain of two Microsoft SharePoint vulnerabilities, CVE-2026-55040 and CVE-2026-63520, to achieve remote code execution on unpatched servers. This exploitation chain allows attackers to bypass authentication and then execute arbitrary code, posing a significant risk to organizations using vulnerable SharePoint installations.

Microsoft has patched a maximum-severity vulnerability, CVE-2026-69836, in its Entra ID identity and access management platform, which was actively exploited in attacks. This flaw allowed unprivileged attackers to achieve code execution over a network, but Microsoft states no user action is required as the mitigation is complete.

Microsoft released 22 new security updates addressing critical and high-severity vulnerabilities across multiple products, including Azure, Entra ID, and Exchange. These patches resolve issues like elevation of privilege and remote code execution flaws, with some having a CVSS score of 10/10. The updates are significant for maintaining the security posture of Microsoft's cloud services and enterprise products, as many of the vulnerabilities could lead to severe system compromise.

Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in its Entra ID service, which was actively exploited. The flaw, rated 10.0 CVSS, allowed unauthorized attackers to execute code over a network, but Microsoft states no customer action is required as it has been fully mitigated.

CISA has added four critical vulnerabilities affecting Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. These flaws allow for unauthorized access, code execution, and bypass of security features, posing significant risks to affected systems globally.

The US Cybersecurity and Infrastructure Infrastructure Security Agency (CISA) has issued an urgent warning for organizations to patch four actively exploited vulnerabilities in Microsoft, VMware, and Apple products. These flaws include critical remote code execution and authentication bypass issues that threat actors are already leveraging in attacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component (CVE-2026-33824) is being actively exploited by attackers. This vulnerability allows unauthenticated attackers to execute code on unpatched Windows systems, posing a significant risk to federal agencies and other organizations.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting CVE-2025-60710, a high-severity Windows Task Host privilege escalation vulnerability. This exploitation allows attackers to gain SYSTEM privileges on unpatched Windows 11 and Windows Server 2025 devices, posing a significant risk to federal agencies and other organizations.

Threat actors are exploiting CVE-2026-55040, a critical authentication bypass vulnerability in Microsoft SharePoint, following the public release of a proof-of-concept (PoC) exploit. This vulnerability allows unauthenticated attackers to impersonate users or administrators and access or modify data on vulnerable SharePoint servers.

A SharePoint vulnerability, CVE-2026-55040, patched by Microsoft in July, is now being actively exploited in the wild, with attacks emerging shortly after a public proof-of-concept (PoC) exploit was released. This exploitation allows unauthenticated attackers to bypass security features, potentially leading to file disclosure and data modification in SharePoint instances.

Microsoft's August Patch Tuesday update addresses 421 vulnerabilities across its products, including a Windows zero-day flaw that has been actively exploited. This update is critical for Windows users as the exploited vulnerability allows attackers to gain system privileges without user interaction after an initial intrusion.

A critical authentication bypass vulnerability in Microsoft SharePoint, CVE-2026-55040, is being exploited in attacks after a proof-of-concept (PoC) exploit was published by Rapid7. This flaw allows unprivileged attackers to impersonate SharePoint users or administrators, potentially leading to file disclosure and data modification.

Microsoft released its monthly security updates, addressing 398 vulnerabilities, including a Windows kernel driver flaw (CVE-2026-68820) that is actively being exploited for privilege escalation. The update also includes patches for four critical remote code execution flaws with CVSS scores of 9.8 that do not require user interaction. This update is significant as it addresses an actively exploited vulnerability and numerous other critical issues, requiring immediate attention from system administrators.

Microsoft released patches for 421 vulnerabilities in its August 2026 Patch Tuesday update, including a high-severity zero-day vulnerability (CVE-2026-68820) in the Ancillary Function Driver for WinSock that is actively being exploited. This update is critical for Windows users as it addresses privilege escalation flaws, some of which are publicly disclosed and likely to be exploited.

Security researchers, using AI assistance, discovered a critical exploit chain in Microsoft SharePoint servers (CVE-2026-55040 and CVE-2026-63520) that allows unauthenticated remote code execution. This vulnerability affects SharePoint Server Subscription Edition, 2019, and 2016, enabling attackers to assume any user's identity, including administrators, and run code on the server.

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups are actively exploiting a high-severity Microsoft SharePoint remote code execution vulnerability, CVE-2026-45659. This flaw allows low-privileged attackers to execute arbitrary code on unpatched SharePoint servers, posing a significant risk to organizations using the software.

Microsoft patched over a dozen vulnerabilities across its products, including critical remote code execution and elevation of privilege issues. Apple released an update for a single bug that could bypass Screen Sharing authentication. These updates address security flaws that could be exploited over networks, impacting user security across various platforms.

The Swiss Federal Office for Information Technology and Telecommunication (BIT) reported a breach of its Microsoft SharePoint servers, compromising approximately 200 accounts. This incident highlights the ongoing risk posed by unpatched vulnerabilities, as the attackers likely exploited flaws disclosed and fixed by Microsoft in mid-July.

Switzerland's Federal Office for Information Technology and Communications (BIT) disclosed that hackers compromised approximately 200 accounts on its on-premises SharePoint servers. The agency suspects the attack exploited vulnerabilities identified in July's Patch Tuesday, which are also listed in CISA's Known Exploited Vulnerabilities catalog. This incident highlights the ongoing risk associated with SharePoint vulnerabilities, particularly for organizations exposing the service directly to the internet.

A proof-of-concept exploit for "Certighost" (CVE-2026-54121), a vulnerability in Windows Active Directory Certificate Services, has been publicly released. This exploit allows authenticated attackers to potentially compromise a Windows domain by impersonating a Domain Controller and performing privileged Active Directory operations.

Security researchers published a working exploit, dubbed Certighost, that allows a low-privileged Active Directory user to obtain a certificate for a Domain Controller and authenticate as that machine. This exploit leverages a flaw in Active Directory Certificate Services (AD CS) that Microsoft patched as CVE-2026-54121, enabling attackers to potentially retrieve the krbtgt secret through DCSync.

Check Point released security updates for its Security Management and Multi-Domain Management products, addressing multiple vulnerabilities including one actively exploited in the wild. The critical flaw, CVE-2026-16232, allowed unauthenticated remote attackers to gain full administrative privileges on SmartConsole. This impacts customers with management servers exposed directly to the internet without IP restrictions, enabling attackers to modify security policies and configurations.

Another SharePoint vulnerability, CVE-2026-50522, has been exploited in the wild, marking the fourth such case in a month. This critical flaw allows remote code execution and has been confirmed by multiple security firms as a significant risk to affected organizations.

Hackers are exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys, enabling long-term unauthorized access to affected servers. Microsoft had previously issued patches for this deserialization flaw, but with the public release of proof-of-concept exploit code, attackers began targeting vulnerable installations immediately.

CVE-2026-50522 in Microsoft SharePoint Server, with a CVSS score of 9.8, is actively being exploited following the release of a public proof-of-concept exploit. This vulnerability allows an attacker with Site Owner credentials to execute arbitrary code remotely, posing significant risks to on-premises SharePoint deployments.

CISA reports ongoing exploitation of the critical RCE vulnerability CVE-2026-58644 in Microsoft SharePoint. This flaw has a CVSS score of 9.8 and allows attackers to execute arbitrary code, prompting urgent patching recommendations for federal agencies.

CISA has included CVE-2026-58644, a critical zero-day vulnerability in Microsoft SharePoint, in its Known Exploited Vulnerabilities catalog. Agencies must implement fixes by July 19, 2026, following reports of active exploitation.

CISA has directed federal agencies to patch a critical vulnerability in Oracle E-Business Suite by July 18 due to ongoing exploitation. The vulnerability allows unauthenticated attackers to gain control of systems, highlighting significant risks in federal cybersecurity.

CISA has urged immediate patching of multiple zero-day vulnerabilities in Microsoft SharePoint, including newly disclosed CVE-2026-56164. These critical vulnerabilities pose serious risks for organizations if not addressed promptly, particularly in potential remote code execution scenarios.

CISA has issued a warning regarding three actively exploited vulnerabilities in on-premises SharePoint Server instances. This is significant as exploited vulnerabilities could allow attackers to execute remote code, steal sensitive keys, and deploy malware on affected systems.

Microsoft released its largest Patch Tuesday ever, addressing 622 vulnerabilities, including two zero-days being actively exploited in the wild. The critical patches for SharePoint Server and Active Directory Federation Services are essential due to their potential for privilege escalation attacks.

Microsoft released patches for 622 vulnerabilities, including two zero-days in Active Directory and SharePoint Server. The fixes address critical security flaws, significantly enhancing protection for users and organizations against potential exploits.

CISA has confirmed that a high-severity remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-45659, is being actively exploited. This flaw allows low-privileged authenticated attackers to execute arbitrary code on vulnerable servers, posing significant risks especially for federal agencies that must secure their systems by a mandated deadline.

CISA has identified a high-severity vulnerability (CVE-2026-45659) in Microsoft SharePoint Server being actively exploited by threat actors. This flaw allows attackers with site member permissions to execute arbitrary code, emphasizing the need for urgent patching by organizations.

CISA added CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog due to active exploitation. This flaw allows authenticated attackers to execute code without elevated privileges, impacting network security for federal agencies required to apply patches by July 4, 2026.