[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZl5eujPMsC818DYT_pizV2EV9rgqzG2PaxLAdrWFxws":3},{"article":4,"iocs":54,"watch_terms":70,"solutions":71,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"24933471-fe2a-462f-9fca-9c796e68d8a0","Hackers target Microsoft SharePoint RCE chain with PoC exploit","hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit-8415d7","Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. [...]","Attackers are actively exploiting a chain of two Microsoft SharePoint vulnerabilities (CVE-2026-55040 and CVE-2026-63520) to achieve remote code execution on unpatched servers. The first flaw bypasses authentication, allowing attackers to act as a user, and the second, in Business Connectivity Services, enables RCE when chained. Proof-of-concept exploits are publicly available, and threat actors have already weaponized the first vulnerability.","Hackers exploit chained Microsoft SharePoint vulnerabilities for RCE.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F26\u002FMicrosoft-SharePoint.jpg","2026-08-26T14:47:51+00:00","2026-08-26T16:00:25.307046+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft SharePoint","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":19},"Business Connectivity Services",{"name":26,"type":22},"Defused",{"name":28,"type":22},"Rapid7",{"name":30,"type":22},"VulnCheck","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68],{"type":56,"value":57,"context":58},"cve","CVE-2026-55040","Authentication bypass flaw in JWT token validation",{"type":56,"value":60,"context":61},"CVE-2026-63520","Vulnerability in SharePoint's Business Connectivity Services (BCS) chained for RCE",{"type":56,"value":63,"context":64},"CVE-2026-32201","Previously warned about by CISA for SharePoint exploitation",{"type":56,"value":66,"context":67},"CVE-2026-45659","Previously warned about by CISA for SharePoint exploitation, now used in ransomware",{"type":56,"value":69,"context":64},"CVE-2026-56164",[21,26,28],{"controls":72,"vendors":153},[73,102,126],{"slug":74,"name":75,"problem":76,"products":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,111,119],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":103,"product_name":108,"url":109,"description":110},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":120,"vendor_name":21,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":53,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":147,"vendor_name":26,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[154,157],{"slug":147,"name":26,"logo_path":148,"roles":155},[156],"reported_by",{"slug":120,"name":21,"logo_path":121,"roles":158},[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":175},"chained-sharepoint-rce-flaws-actively-exploited-via-public-poc","Chained SharePoint RCE Flaws Actively Exploited via Public PoC","Attackers are chaining two unpatched Microsoft SharePoint vulnerabilities — an authentication bypass and a remote code execution flaw in Business Connectivity Services — to fully compromise unpatched servers. The public availability of proof-of-concept exploit code dramatically lowers the barrier for threat actors, accelerating the window between disclosure and mass exploitation. Organizations running unpatched SharePoint instances face severe risk of complete server compromise, data theft, and lateral movement within their networks. This incident underscores that delayed patching of internet-facing, business-critical platforms can be catastrophic once a working PoC enters the wild.",[165,166,167,168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1078: Valid Accounts (Authentication Bypass)",{}]