Loading story…
Microsoft disclosed and patched several remote code execution vulnerabilities affecting Exchange Server and SharePoint Server, including Exchange flaws tracked as CVE-2023-21706, CVE-2023-28310, and CVE-2023-36439, alongside SharePoint issues CVE-2026-33110, CVE-2026-33112, and CVE-2026-40368. The SharePoint vulnerabilities were tied to deserialization of untrusted data and were rated Important, with CVSS scores of 8.8 for CVE-2026-33110 and CVE-2026-33112, and 8.0 for CVE-2026-40368.
Microsoft said CVE-2026-33110 could let an authenticated attacker with at least Site Member permissions execute code remotely on a vulnerable SharePoint Server, while CVE-2026-33112 required at least Site Owner privileges to inject and run arbitrary code. For CVE-2026-40368, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were not publicly disclosed and not exploited in the wild at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for SharePoint Server 2016 and SharePoint Enterprise Server 2016.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-33110, CVE-2026-33112, and CVE-2026-40368 affecting SharePoint Server and Office SharePoint, all involving deserialization of untrusted data. Microsoft said none were publicly disclosed or exploited in the wild at publication and that official fixes were available.
Microsoft published security guidance for CVE-2023-36439, a Microsoft Exchange Server remote code execution vulnerability. The advisory represents a new Exchange Server RCE disclosure by Microsoft.
Microsoft published security guidance for CVE-2023-28310, another Microsoft Exchange Server remote code execution vulnerability. This marks a separate Exchange Server RCE disclosure in the Security Update Guide.
Microsoft published security guidance for CVE-2023-21706, a Microsoft Exchange Server remote code execution vulnerability. The reference indicates the vulnerability was formally disclosed in Microsoft's Security Update Guide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Jul 17, 2026
Microsoft published security advisories for **CVE-2025-49704** and **CVE-2025-49701**, identifying both flaws as **Microsoft SharePoint Remote Code Execution** vulnerabilities. The entries were added to the Microsoft Security Update Guide, indicating that SharePoint deployments are affected by vulnerabilities that could allow code execution on targeted systems. The advisories provide formal tracking for two separate SharePoint RCE issues and signal that organizations running Microsoft SharePoint should review the associated update guidance and remediation information for both CVEs. The dual disclosure highlights concurrent risk in a widely used enterprise collaboration platform and raises the urgency for defenders to assess exposure across SharePoint environments.
Jun 29, 2026