[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwJFWX5mLi6LTmtqG_5q9axnvP4RoaEm3Qvvc5vGDbAA":3},{"article":4,"iocs":49,"watch_terms":66,"solutions":67,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d05a7283-18fe-4db2-b88c-68521d450dc4","SharePoint Vulnerability Exploited Shortly After PoC Release","sharepoint-vulnerability-exploited-shortly-after-poc-release-11be2f","The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild. The post SharePoint Vulnerability Exploited Shortly After PoC Release appeared first on SecurityWeek.","A SharePoint vulnerability, CVE-2026-55040, patched by Microsoft in July, is now actively being exploited in the wild. The exploitation began shortly after a proof-of-concept exploit was released by Rapid7. This vulnerability allows attackers to bypass authentication and disclose files or modify data. Separately, CVE-2026-63520, another SharePoint flaw that can be chained with CVE-2026-55040 for unauthenticated RCE, was patched in August.","SharePoint vulnerability CVE-2026-55040 is being exploited in the wild after PoC release.","https:\u002F\u002Fwww.securityweek.com\u002Fsharepoint-vulnerability-exploited-shortly-after-poc-release\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FSharePoint.jpeg","2026-08-12T14:47:01+00:00","2026-08-12T16:00:12.7975+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"SharePoint","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":19},"PoC exploit",{"name":26,"type":19},"Honeypots",{"name":28,"type":22},"Rapid7",{"name":30,"type":22},"Defused","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60,62,64],{"type":51,"value":52,"context":53},"cve","CVE-2026-55040","SharePoint vulnerability actively exploited after PoC release.",{"type":51,"value":55,"context":56},"CVE-2026-63520","SharePoint vulnerability that can be chained with CVE-2026-55040 for RCE.",{"type":51,"value":58,"context":59},"CVE-2026-50522","Previously exploited SharePoint vulnerability.",{"type":51,"value":61,"context":59},"CVE-2026-58644",{"type":51,"value":63,"context":59},"CVE-2026-56164",{"type":51,"value":65,"context":59},"CVE-2026-45659",[21,28,30],{"controls":68,"vendors":148},[69,97,121],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,89],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":28,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,109,113],{"vendor_slug":103,"vendor_name":21,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":98,"product_name":110,"url":111,"description":112},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":48,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,140],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":30,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[149,152,155],{"slug":134,"name":30,"logo_path":135,"roles":150},[151],"reported_by",{"slug":103,"name":21,"logo_path":104,"roles":153},[154],"affected",{"slug":83,"name":28,"logo_path":84,"roles":156},[151],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":171},"sharepoint-auth-bypass-exploited-days-after-poc-publication","SharePoint Auth Bypass Exploited Days After PoC Publication","CVE-2026-55040, a Microsoft SharePoint authentication bypass vulnerability patched in July, was rapidly weaponized by threat actors shortly after Rapid7 published a proof-of-concept exploit — a classic illustration of the shrinking window between disclosure and active exploitation. When chained with a second flaw (CVE-2026-63520), attackers can achieve unauthenticated remote code execution, dramatically raising the stakes for unpatched organizations. This incident underscores that patch timelines must be treated as race conditions: the moment a PoC is public, unpatched systems are effectively open targets. Organizations that lack prioritized, risk-based patching workflows for internet-facing services like SharePoint face disproportionate exposure to both data theft and full system compromise.",[162,163,164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","ITIL Change Management: Emergency Change Procedure","GDPR Article 32: Security of Processing (for EU-hosted SharePoint data)","ISO 27001 Annex A.12.6: Management of Technical Vulnerabilities",{}]