Loading story…
Researchers disclosed a post-authentication server-side request forgery (SSRF) flaw in Microsoft SharePoint Server 2019 affecting the /<site>/_api/web/ExecuteRemoteLOB endpoint. The vulnerability lets an authenticated user with access to a valid SharePoint site send highly customizable HTTP(S) requests to arbitrary URLs and read response bodies when the target returns a 2xx status, creating opportunities for internal network scanning and interaction with internal services.
The issue was traced to Microsoft.SharePoint.BusinessData.SystemSpecific.OData.ODataHybridHelper.InvokeODataService in Microsoft.SharePoint.dll, which builds an HttpWebRequest from attacker-controlled BCSOData-* headers and can also forward request bodies for POST and PUT methods. STAR Labs said it reproduced the bug on Windows Server 2022 running SharePoint Server 2019 version 16.0.10386.20011 with KB5002207, and identified affected versions as SharePoint Server 2019 up to 16.0.10386.20011; Microsoft later fixed the flaw, but no CVE identifier was assigned.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published technical details and a proof of concept for the post-authentication SSRF vulnerability in Microsoft SharePoint Server 2019. The write-up described the vulnerable code path in Microsoft.SharePoint.dll and exploitation via attacker-controlled BCSOData headers.
Microsoft informed the researchers that the SharePoint Server 2019 SSRF vulnerability had been fixed. The issue reportedly affected versions up to 16.0.10386.20011 and did not receive a CVE identifier.
STAR Labs disclosed a post-authentication SSRF vulnerability in Microsoft SharePoint Server 2019 to Microsoft. The flaw affected the ExecuteRemoteLOB endpoint and allowed authenticated users to send customizable HTTP(S) requests to arbitrary URLs and read 2xx responses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-56164**, an elevation-of-privilege vulnerability in **Microsoft SharePoint Server** caused by missing authentication for a critical function. The flaw is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and Microsoft says exploitation has been detected in the wild. Reporting on the issue indicates attackers can abuse improper request validation in a SharePoint client service endpoint to bypass expected `X-RequestDigest` checks under certain routing conditions and obtain an elevated administrative security context. Successful exploitation can allow unauthorized takeover of site collections and farm configurations, data exfiltration, persistence through permission changes, and potential lateral movement into the wider Windows Server environment, particularly on internet-exposed SharePoint systems. Microsoft has released a security update and recommends enabling **AMSI integration** and full request-body scanning in SharePoint and IIS worker process memory; additional reporting also points to IIS URL Rewrite filtering of unauthenticated requests to the vulnerable client service endpoint as a temporary defensive measure.
Aug 31, 2026
Rapid7 and Microsoft disclosed **`CVE-2026-63520`**, a high-severity remote code execution flaw in Microsoft SharePoint that can be chained with the previously disclosed authentication bypass **`CVE-2026-55040`** to achieve **unauthenticated RCE** on vulnerable on-premises SharePoint servers. The chain affects supported SharePoint versions and also impacts certain versions of Microsoft Project Server and Microsoft Office Web Apps Server, with the initial authentication bypass also reported to affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft advised customers to apply the latest updates, and Rapid7 said July updates disrupted the exploit chain while the RCE fix was disclosed separately. Rapid7 said **`CVE-2026-55040`** lets attackers forge JWTs and impersonate SharePoint users or administrators by exploiting multiple weaknesses in SharePoint's token validation pipeline, including inadequate signature enforcement and certificate validation. Attackers can obtain the SharePoint STS signing certificate from an unauthenticated metadata endpoint, craft forged nested JWTs, and access authenticated endpoints before using **`CVE-2026-63520`** in Business Connectivity Services, where unsafe .NET type instantiation enables arbitrary code execution under the SharePoint Site service account. Researchers said the exploit chain was developed during a zero-day research project using AI-assisted workflows, while noting that expert oversight was required throughout the discovery process.
Aug 26, 2026
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Aug 25, 2026