tag: Sharepoint · 13 items
- Engineer — Act: Warlock is actively weaponizing both old and new SharePoint vulnerabilities to disable endpoint defenses and deploy ransomware; patch SharePoint to the latest available version immediately and audit recent access logs for exploitation artifacts.
- SOC/IR — Act: Two-vendor corroboration (Symantec and Carbon Black) of live ransomware deployments via SharePoint exploitation warrants a retroactive hunt for security-tool-kill events and SharePoint lateral movement patterns since at least early Q4 2026.
- Leader — Plan: Confirm SharePoint patch compliance with engineering this quarter and validate that endpoint-defense controls can detect tampering; current targeting is concentrated in Portuguese- and Spanish-speaking critical infrastructure, but the TTPs are sector-portable.
- Engineer — Plan: Active exploitation of SharePoint for initial access is confirmed across multiple org types, but no specific CVE, KEV listing, or PoC is surfaced in the signals; ensure SharePoint is fully patched and audit authentication/access logs for anomalous behavior this sprint.
- SOC/IR — Act: An active China-linked ransomware campaign is using SharePoint exploitation as the entry point against water, telecom, government, and education targets; hunt for SharePoint exploitation indicators (unusual web shell activity, anonymous auth attempts) and check whether your estate’s sector matches the targeting profile.
- Leader — Act: A named state-linked ransomware group is actively targeting water utilities, telecom operators, regional governments, and universities via SharePoint — if your organization operates in any of these sectors, brief leadership now and confirm SharePoint patch posture and segmentation with engineering before this surfaces as a board question.
- Engineer — Act: SharePoint (CVE-2026-65660, CVSS 8.8) is CISA KEV-listed, has a public PoC, and is seeing active exploitation — patch immediately per Microsoft’s advisory. Also audit MikroTik RouterOS firmware versions and apply vendor patches for the co-listed flaw.
- SOC/IR — Act: Active exploitation of both SharePoint and MikroTik RouterOS means assume-breach posture for those surfaces: hunt SharePoint access logs for code-injection patterns and sweep network edge devices running RouterOS for anomalous outbound connections or config changes since the KEV listing date.
- Leader — Plan: Confirm whether SharePoint and MikroTik RouterOS appear in your asset inventory and verify engineering teams are tracking CISA BOD remediation timelines; no board-level communication required unless your sector has seen confirmed targeting or you are under federal compliance obligations.
- Signals: CVE-2026-65660 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Plan: The CVSS 6.5 spoofing label may have caused teams to deprioritize this patch; full technical details are now public, raising PoC risk. Patch SharePoint Server 2016, 2019, and Subscription Edition to the vendor-supplied fix before a PoC materializes.
- SOC/IR — Plan: With detailed exploit mechanics now public, exploitation attempts are more likely in coming weeks. Build or stage SharePoint-targeted authenticated RCE hunt queries now so you can sweep quickly if active exploitation is reported.
- Leader — Skip
- Signals: CVE-2026-65660 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Learn: SharePoint RCE chain and AI-assisted botnet techniques are worth tracking, but the summary provides no CVE, EPSS, KEV, or patch target — read the full digest to identify whether any specific component you run is affected.
- SOC/IR — Learn: C2 traffic hiding in public infrastructure and delayed-payload malware are tactically interesting detection themes, but no IOCs or ATT&CK mappings are surfaced here — use this as a prompt to review whether relevant log sources (DNS, proxy) would catch these patterns.
- Leader — Learn: The mention of over 100 water systems targeted is notable for critical-infrastructure sector awareness, but this is a vague digest with no specifics suitable for a leadership brief or risk-register update.
- Engineer — Act: SharePoint CVSS 9.1 authentication bypass is now under active exploitation following public PoC release; apply Microsoft’s July 2026 Patch Tuesday update to all on-premises and hybrid SharePoint instances immediately and verify patch status in your estate.
- SOC/IR — Act: Active exploitation of a SharePoint auth bypass means adversaries may already be inside unpatched tenants; hunt for anomalous SharePoint authentication events and unexpected file access patterns in audit logs dating back to the PoC release.
- Leader — Act: SharePoint is ubiquitous in enterprise environments and this critical auth bypass is under active attack; confirm patch completion with engineering this week and assess whether any exposure window existed that could trigger customer notification obligations.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Public PoC is live and attackers are already exploiting this critical SharePoint flaw — patch SharePoint on-prem deployments immediately and audit SharePoint ULS and IIS logs for anomalous authentication or anonymous access patterns from the PoC release date forward.
- SOC/IR — Act: Active in-the-wild exploitation means an immediate hunt is warranted — query SIEM for unusual SharePoint authentication events, abnormal REST/SOAP API calls, or unexpected file-access patterns since Rapid7’s PoC publication date, and tune alerts on SharePoint edge access.
- Leader — Plan: A critical SharePoint vulnerability with a public PoC and confirmed exploitation warrants confirming on-prem SharePoint exposure with your engineering team and ensuring an emergency patch window is scheduled this week if not already done.
- Engineer — Act: Public PoC on GitHub for a CVSS 9.1 unauthenticated RCE across SharePoint Server Subscription Edition, 2019, and 2016 means exploitation risk is immediate even without KEV listing; apply Microsoft’s patch for CVE-2026-55040 across all affected on-prem SharePoint instances this week.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet (EPSS 0.02, no KEV), but a public PoC for unauthenticated RCE warrants building SharePoint-specific detections now — hunt for anomalous unauthenticated requests to SharePoint REST/SOAP endpoints and tune alerts on privilege escalation patterns in SharePoint audit logs before active campaigns emerge.
- Leader — Plan: A CVSS 9.1 unauthenticated RCE with public PoC against widely deployed SharePoint Server warrants confirming on-prem SharePoint scope with your team and ensuring patch prioritization this sprint — escalate to Act if exploitation is observed in the wild.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Plan: SharePoint server vulnerabilities are plausible exposure for organizations running on-prem or hybrid SharePoint; audit your SharePoint patch level and review exposed endpoints, though no specific CVE or PoC is cited in available signals.
- SOC/IR — Plan: No IOCs or TTPs are published yet, but a confirmed SharePoint breach compromising 200 accounts warrants building or tuning detections for SharePoint authentication anomalies and mass account access patterns in anticipation of further disclosure.
- Leader — Learn: A nation-state-level SharePoint compromise affecting a federal government is a useful benchmark for board discussions on identity hygiene and on-prem collaboration platform risk, but no vendor exposure or regulatory deadline is triggered here.
- Engineer — Act: Active exploitation confirmed with a public GitHub PoC; patch SharePoint immediately AND regenerate machine keys — patching alone does not evict attackers who already exfiltrated them, so key rotation is the critical second step.
- SOC/IR — Act: Stolen machine keys enable persistent, post-patch impersonation attacks — hunt SharePoint IIS logs for exploitation artifacts since the vulnerability became public, and write detections for anomalous ViewState or token-forging activity tied to mismatched machine keys.
- Leader — Plan: Confirm SharePoint is in scope, then ensure your engineering team understands that patching alone is insufficient — key rotation and a post-exploitation sweep are required; flag this as a two-step remediation so it isn’t closed prematurely in the ticket queue.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.8 deserialization RCE with public PoC and confirmed active exploitation — patch SharePoint Server to the July 2026 Patch Tuesday build immediately; do not wait for CISA KEV confirmation given exploitation is already underway.
- SOC/IR — Act: Active exploitation predating your patch window means assume-breach posture is warranted — hunt for anomalous deserialization or code execution activity on SharePoint servers back to at least the PoC publication date, and review watchTowr’s reporting for any available IOCs or behavioral signatures.
- Leader — Act: A CVSS 9.8 unauthenticated RCE in widely-deployed enterprise SharePoint under active exploitation requires a same-week exposure check — confirm whether the org runs on-premises SharePoint Server and verify the engineering team has prioritized the July Patch Tuesday update.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: SharePoint Server CVE-2026-58644 (CVSS 9.8) is KEV-listed with active exploitation and a public GitHub PoC — patch immediately; federal deadline is July 19, 2026, so treat this as emergency priority regardless of your organization type.
- SOC/IR — Act: With active exploitation confirmed and a public PoC live, treat any on-prem SharePoint Server as potentially compromised — sweep SharePoint ULS/IIS logs for deserialization anomalies and unusual POST requests to SharePoint endpoints since the vulnerability was disclosed.
- Leader — Act: A CVSS 9.8 SharePoint RCE is actively exploited and KEV-listed with a two-day federal remediation deadline — confirm this week whether your environment runs SharePoint Server on-prem and verify the engineering team has emergency patching underway before the July 19 deadline.
- Signals: CVE-2026-58644 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA warning indicates KEV-level active exploitation against internet-exposed on-premises SharePoint Server. Apply Microsoft’s patches immediately and verify no externally reachable SharePoint instances remain unpatched.
- SOC/IR — Act: Active exploitation of internet-facing SharePoint means assume-breach posture is warranted; hunt for post-exploitation activity (lateral movement, credential access) on SharePoint hosts since the earliest known exploitation date and review IIS/ULS logs for anomalous request patterns.
- Leader — Act: Confirm whether the organization runs on-premises SharePoint Server exposed to the internet, and get a patching status update from engineering this week — active exploitation with a CISA advisory is the kind of event that surfaces in board or customer security reviews.