Loading story…
Microsoft published security advisories for two denial-of-service vulnerabilities affecting widely deployed enterprise software: CVE-2024-43466 in Microsoft SharePoint Server and CVE-2026-23666 in the .NET Framework. Both entries were released through the Microsoft Security Response Center's Security Update Guide, identifying the products and impact category as denial of service.
The disclosures indicate that organizations running on-premises SharePoint environments or applications dependent on the .NET Framework should review Microsoft's update guidance and assess exposure across affected systems. While the advisories provided limited public technical detail, the combination of flaws highlights continued risk to core Microsoft infrastructure components that support collaboration platforms and business applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-23666 to its Security Update Guide as a .NET Framework denial-of-service vulnerability.
Microsoft added CVE-2024-43466 to its Security Update Guide as a Microsoft SharePoint Server denial-of-service vulnerability.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for **CVE-2025-49704** and **CVE-2025-49701**, identifying both flaws as **Microsoft SharePoint Remote Code Execution** vulnerabilities. The entries were added to the Microsoft Security Update Guide, indicating that SharePoint deployments are affected by vulnerabilities that could allow code execution on targeted systems. The advisories provide formal tracking for two separate SharePoint RCE issues and signal that organizations running Microsoft SharePoint should review the associated update guidance and remediation information for both CVEs. The dual disclosure highlights concurrent risk in a widely used enterprise collaboration platform and raises the urgency for defenders to assess exposure across SharePoint environments.
Jun 29, 2026
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026
Microsoft released its largest Patch Tuesday update on record, fixing roughly **570 to 622 Microsoft CVEs** across Windows, Office, SharePoint Server, Exchange Server, SQL Server, Edge, Azure, Defender, and developer tools. The release included **three zero-days**, with **CVE-2026-56155** in **Active Directory Federation Services (AD FS)** and **CVE-2026-56164** in **on-premises Microsoft SharePoint Server** confirmed as exploited in the wild, while **CVE-2026-50661** patched a publicly disclosed **BitLocker** security feature bypass requiring physical access. Microsoft and multiple security outlets said the surge in findings was partly driven by AI-assisted vulnerability discovery, while the broader update also addressed dozens of critical remote code execution flaws in services such as DHCP, Hyper-V, Office, Exchange, SQL Server, Copilot, and SharePoint. U.S. agencies and industry groups elevated the urgency around SharePoint after CISA warned that attackers were actively exploiting **CVE-2026-56164** alongside **CVE-2026-32201** and **CVE-2026-45659** against internet-exposed on-premises servers, enabling unauthorized access, remote code execution, theft of IIS machine keys, persistence, and malware deployment. CISA added the exploited AD FS and SharePoint flaws to its **Known Exploited Vulnerabilities** catalog and urged immediate remediation, while Microsoft recommended SharePoint hardening measures including **AMSI integration with full request body scanning** and stronger Defender protections; exposed identity systems, SharePoint farms, and other internet-facing Microsoft services were identified as the highest-priority patch targets.
Jul 24, 2026