Sharepoint on CuraSec

ThreatsDay Digest: IoT Botnet, Water Systems, SharePoint RCE

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: SharePoint RCE chain and AI-assisted botnet techniques are worth tracking, but the summary provides no CVE, EPSS, KEV, or patch target — read the full digest to identify whether any specific component you run is affected.
SOC/IR — Learn: C2 traffic hiding in public infrastructure and delayed-payload malware are tactically interesting detection themes, but no IOCs or ATT&CK mappings are surfaced here — use this as a prompt to review whether relevant log sources (DNS, proxy) would catch these patterns.
Leader — Learn: The mention of over 100 water systems targeted is notable for critical-infrastructure sector awareness, but this is a vague digest with no specifics suitable for a leadership brief or risk-register update.

Attackers exploit critical SharePoint vulnerability using public PoC

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Act: Public PoC is live and attackers are already exploiting this critical SharePoint flaw — patch SharePoint on-prem deployments immediately and audit SharePoint ULS and IIS logs for anomalous authentication or anonymous access patterns from the PoC release date forward.
SOC/IR — Act: Active in-the-wild exploitation means an immediate hunt is warranted — query SIEM for unusual SharePoint authentication events, abnormal REST/SOAP API calls, or unexpected file-access patterns since Rapid7’s PoC publication date, and tune alerts on SharePoint edge access.
Leader — Plan: A critical SharePoint vulnerability with a public PoC and confirmed exploitation warrants confirming on-prem SharePoint exposure with your engineering team and ensuring an emergency patch window is scheduled this week if not already done.

SharePoint Auth Bypass CVE-2026-55040 Actively Exploited After PoC

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Act: SharePoint CVSS 9.1 authentication bypass is now under active exploitation following public PoC release; apply Microsoft’s July 2026 Patch Tuesday update to all on-premises and hybrid SharePoint instances immediately and verify patch status in your estate.
SOC/IR — Act: Active exploitation of a SharePoint auth bypass means adversaries may already be inside unpatched tenants; hunt for anomalous SharePoint authentication events and unexpected file access patterns in audit logs dating back to the PoC release.
Leader — Act: SharePoint is ubiquitous in enterprise environments and this critical auth bypass is under active attack; confirm patch completion with engineering this week and assess whether any exposure window existed that could trigger customer notification obligations.
Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub

CVE-2026-55040: Unauthenticated RCE in SharePoint Server, PoC Public

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Act: Public PoC on GitHub for a CVSS 9.1 unauthenticated RCE across SharePoint Server Subscription Edition, 2019, and 2016 means exploitation risk is immediate even without KEV listing; apply Microsoft’s patch for CVE-2026-55040 across all affected on-prem SharePoint instances this week.
SOC/IR — Plan: No confirmed in-the-wild exploitation yet (EPSS 0.02, no KEV), but a public PoC for unauthenticated RCE warrants building SharePoint-specific detections now — hunt for anomalous unauthenticated requests to SharePoint REST/SOAP endpoints and tune alerts on privilege escalation patterns in SharePoint audit logs before active campaigns emerge.
Leader — Plan: A CVSS 9.1 unauthenticated RCE with public PoC against widely deployed SharePoint Server warrants confirming on-prem SharePoint scope with your team and ensuring patch prioritization this sprint — escalate to Act if exploitation is observed in the wild.
Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub

Swiss government SharePoint breach compromised 200 accounts

Fri, 07 Aug 2026 00:21:58 +0000

Engineer — Plan: SharePoint server vulnerabilities are plausible exposure for organizations running on-prem or hybrid SharePoint; audit your SharePoint patch level and review exposed endpoints, though no specific CVE or PoC is cited in available signals.
SOC/IR — Plan: No IOCs or TTPs are published yet, but a confirmed SharePoint breach compromising 200 accounts warrants building or tuning detections for SharePoint authentication anomalies and mass account access patterns in anticipation of further disclosure.
Leader — Learn: A nation-state-level SharePoint compromise affecting a federal government is a useful benchmark for board discussions on identity hygiene and on-prem collaboration platform risk, but no vendor exposure or regulatory deadline is triggered here.

Critical SharePoint RCE CVE-2026-50522 Actively Exploited After PoC

Wed, 22 Jul 2026 12:46:13 +0000

Engineer — Act: CVSS 9.8 deserialization RCE with public PoC and confirmed active exploitation — patch SharePoint Server to the July 2026 Patch Tuesday build immediately; do not wait for CISA KEV confirmation given exploitation is already underway.
SOC/IR — Act: Active exploitation predating your patch window means assume-breach posture is warranted — hunt for anomalous deserialization or code execution activity on SharePoint servers back to at least the PoC publication date, and review watchTowr’s reporting for any available IOCs or behavioral signatures.
Leader — Act: A CVSS 9.8 unauthenticated RCE in widely-deployed enterprise SharePoint under active exploitation requires a same-week exposure check — confirm whether the org runs on-premises SharePoint Server and verify the engineering team has prioritized the July Patch Tuesday update.
Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources

Critical SharePoint RCE exploited to steal machine keys for persistence

Wed, 22 Jul 2026 12:46:13 +0000

Engineer — Act: Active exploitation confirmed with a public GitHub PoC; patch SharePoint immediately AND regenerate machine keys — patching alone does not evict attackers who already exfiltrated them, so key rotation is the critical second step.
SOC/IR — Act: Stolen machine keys enable persistent, post-patch impersonation attacks — hunt SharePoint IIS logs for exploitation artifacts since the vulnerability became public, and write detections for anomalous ViewState or token-forging activity tied to mismatched machine keys.
Leader — Plan: Confirm SharePoint is in scope, then ensure your engineering team understands that patching alone is insufficient — key rotation and a post-exploitation sweep are required; flag this as a two-step remediation so it isn’t closed prematurely in the ticket queue.
Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources

CISA KEV: SharePoint RCE Zero-Day CVE-2026-58644 Actively Exploited

Fri, 17 Jul 2026 12:06:10 +0000

Engineer — Act: SharePoint Server CVE-2026-58644 (CVSS 9.8) is KEV-listed with active exploitation and a public GitHub PoC — patch immediately; federal deadline is July 19, 2026, so treat this as emergency priority regardless of your organization type.
SOC/IR — Act: With active exploitation confirmed and a public PoC live, treat any on-prem SharePoint Server as potentially compromised — sweep SharePoint ULS/IIS logs for deserialization anomalies and unusual POST requests to SharePoint endpoints since the vulnerability was disclosed.
Leader — Act: A CVSS 9.8 SharePoint RCE is actively exploited and KEV-listed with a two-day federal remediation deadline — confirm this week whether your environment runs SharePoint Server on-prem and verify the engineering team has emergency patching underway before the July 19 deadline.
Signals: CVE-2026-58644 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub

CISA: Three SharePoint Server flaws actively exploited in the wild

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Act: CISA warning indicates KEV-level active exploitation against internet-exposed on-premises SharePoint Server. Apply Microsoft’s patches immediately and verify no externally reachable SharePoint instances remain unpatched.
SOC/IR — Act: Active exploitation of internet-facing SharePoint means assume-breach posture is warranted; hunt for post-exploitation activity (lateral movement, credential access) on SharePoint hosts since the earliest known exploitation date and review IIS/ULS logs for anomalous request patterns.
Leader — Act: Confirm whether the organization runs on-premises SharePoint Server exposed to the internet, and get a patching status update from engineering this week — active exploitation with a CISA advisory is the kind of event that surfaces in board or customer security reviews.