Loading story…
Microsoft published security advisories for several remote code execution vulnerabilities affecting SharePoint, Microsoft Edge (Chromium-based), Azure Orbital Spatio, Azure Virtual Network Gateway, and Microsoft Power Pages, including CVE-2026-45659, CVE-2026-45495, CVE-2026-40412, CVE-2026-40411, and CVE-2026-23652. The most detailed disclosures focused on SharePoint Server, where Microsoft described CVE-2026-35439 and CVE-2026-40357 as deserialization of untrusted data flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers.
Microsoft rated both SharePoint issues Important with CVSS 8.8 and said exploitation requires valid access, with CVE-2026-35439 requiring at least Site Owner privileges and CVE-2026-40357 requiring Site Member permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Microsoft also disclosed CVE-2026-40362, an Excel heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released an out-of-band fix for CVE-2026-45659, a SharePoint Server remote code execution flaw exploitable by an authenticated attacker with Site Member permissions. The vulnerability was attributed to deserialization of untrusted data and, at the time of reporting, Microsoft said there was no public exploit code or known in-the-wild exploitation.
Microsoft published Security Update Guide entries for CVE-2026-45659 (Microsoft SharePoint), CVE-2026-40412 (Azure Orbital Spatio), CVE-2026-40411 (Azure Virtual Network Gateway), and CVE-2026-23652 (Microsoft Power Pages), all described as remote code execution vulnerabilities. The provided references do not include further technical or exploitation details.
Microsoft added a Security Update Guide entry for CVE-2026-45495, a remote code execution vulnerability in Chromium-based Microsoft Edge. The reference content provides no additional synopsis beyond the advisory publication.
Microsoft published Security Update Guide entries for CVE-2026-35439 and CVE-2026-40357 affecting Microsoft SharePoint Server, and CVE-2026-40362 affecting Microsoft Excel. Microsoft said fixes were available and that none of the flaws were publicly disclosed or exploited in the wild at publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourceccb.belgium.be
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting **Exchange Server** and **SharePoint Server**, including Exchange flaws tracked as `CVE-2023-21706`, `CVE-2023-28310`, and `CVE-2023-36439`, alongside SharePoint issues `CVE-2026-33110`, `CVE-2026-33112`, and `CVE-2026-40368`. The SharePoint vulnerabilities were tied to **deserialization of untrusted data** and were rated **Important**, with CVSS scores of **8.8** for `CVE-2026-33110` and `CVE-2026-33112`, and **8.0** for `CVE-2026-40368`. Microsoft said `CVE-2026-33110` could let an authenticated attacker with at least **Site Member** permissions execute code remotely on a vulnerable SharePoint Server, while `CVE-2026-33112` required at least **Site Owner** privileges to inject and run arbitrary code. For `CVE-2026-40368`, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were **not publicly disclosed** and **not exploited in the wild** at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**.
Jun 29, 2026
Microsoft's May security release addressed **120 vulnerabilities** across Windows, Office, .NET, Azure, Teams, and SharePoint, with no publicly reported zero-days at disclosure. The most urgent on-premises issues included multiple authenticated **SharePoint Server remote code execution** flaws—`CVE-2026-33110`, `CVE-2026-33112`, `CVE-2026-35439`, and `CVE-2026-40357`—that let users with low site-level privileges such as **Site Member** or **Site Owner** execute arbitrary code remotely through unsafe deserialization. Microsoft shipped cumulative updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, and noted there are no workarounds for the affected builds. The same release also patched a large set of **local privilege escalation** bugs across Windows and related components, including the TCP/IP stack (`CVE-2026-34351`), Win32k (`CVE-2026-35417`), the Windows kernel (`CVE-2026-35420`, `CVE-2026-33841`), Event Logging Service (`CVE-2026-33834`), Cloud Files Mini Filter Driver (`CVE-2026-34337`), Storage Spaces Controller (`CVE-2026-35415`), Office Click-to-Run (`CVE-2026-35436`), .NET (`CVE-2026-32177`, `CVE-2026-35433`), and Azure Monitor Agent on Linux (`CVE-2026-32204`). Microsoft also disclosed several high-severity **cloud-service vulnerabilities** that were already remediated server-side, including flaws in Azure DevOps, Azure Cloud Shell, Azure Managed Instance for Apache Cassandra, Azure Machine Learning, Microsoft 365 Copilot Business Chat, Teams Events Portal, Azure Monitor, and Azure AI Foundry, meaning most customers did not need to patch those hosted services directly.
Jul 12, 2026
Microsoft published security advisories for multiple **Important** and **Critical** vulnerabilities affecting *SharePoint Server*, *Microsoft Office/Excel*, Windows components, and *GDI*. The highest-impact server-side issue is **CVE-2026-26114**, a *SharePoint Server* **remote code execution** flaw attributed to **CWE-502 (deserialization of untrusted data)** with a CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N` (base score shown as 8.8), indicating network reachability with low complexity and requiring low privileges. Microsoft also disclosed **CVE-2026-26105**, a *SharePoint Server* **spoofing** issue mapped to **CWE-79 (XSS)** with `AV:N/AC:L/PR:N/UI:R` (base score shown as 8.1), implying remote exploitation that requires user interaction. On the endpoint/application side, Microsoft listed several *Office/Excel* **remote code execution** vulnerabilities: **CVE-2026-26109** (Excel RCE; **CWE-125 out-of-bounds read**; vector `AV:L/AC:L/PR:N/UI:N`, base score shown as 8.4), **CVE-2026-26108** (Excel RCE; **CWE-122 heap-based buffer overflow**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8), and **CVE-2026-26112** (Excel RCE; **CWE-822 untrusted pointer dereference**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8). Microsoft also published **CVE-2026-26113**, a **Critical** *Microsoft Office* RCE (also **CWE-822**) with `AV:L/AC:L/PR:N/UI:N` (base score shown as 8.4); one reference is a duplicate advisory page for the same CVE. Additional component advisories include **CVE-2026-24288** (Windows Mobile Broadband Driver RCE; **CWE-122**; `AV:P/AC:L/PR:N/UI:N`, base score shown as 6.8, requiring physical access) and **CVE-2026-25190** (GDI RCE; **CWE-426 untrusted search path**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8).
Jul 12, 2026