Loading story…
Microsoft released SharePoint security updates KB5002863, KB5002868, and KB5002870 to fix multiple remote code execution vulnerabilities in SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. The SharePoint 2016 and 2019 advisories cite Microsoft Word and SharePoint RCE issues including CVE-2026-40367, CVE-2026-40365, CVE-2026-40357, CVE-2026-33112, CVE-2026-33110, CVE-2026-35439, and CVE-2026-40368, while Microsoft’s download notices say exploitation could lead to arbitrary code execution when a maliciously modified file is opened. The patched builds are 16.0.19725.20280 for Subscription Edition, 16.0.5552.1002 for SharePoint 2016, and 16.0.10417.20128 for SharePoint 2019.
Microsoft said farms running SharePoint Workflow Manager must install KB5002799 before applying the cumulative updates, and deployments using Classic Workflow Manager must enable a debug flag to continue operating. The updates are available through Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center, and they replace earlier SharePoint security updates including KB5002853, KB5002861, and KB5002854. In addition to the security fixes, Microsoft included nonsecurity corrections covering accessibility issues, unsafe user controls, page-loading errors, PowerShell database-exists errors, and ingestion cache throughput improvements.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released SharePoint security updates KB5002863, KB5002868, and KB5002870 for SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. The updates address multiple remote code execution vulnerabilities, including CVEs affecting SharePoint Server and Microsoft Word handling in SharePoint.
Microsoft published Security Update KB5002868 for SharePoint Server 2016. The notice says it addresses a vulnerability that could allow arbitrary code execution when a maliciously modified file is opened.
Microsoft published Security Update KB5002870 for SharePoint Server 2019 Core. The notice says it fixes a vulnerability that could allow arbitrary code execution when a maliciously modified file is opened.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for **CVE-2025-49704** and **CVE-2025-49701**, identifying both flaws as **Microsoft SharePoint Remote Code Execution** vulnerabilities. The entries were added to the Microsoft Security Update Guide, indicating that SharePoint deployments are affected by vulnerabilities that could allow code execution on targeted systems. The advisories provide formal tracking for two separate SharePoint RCE issues and signal that organizations running Microsoft SharePoint should review the associated update guidance and remediation information for both CVEs. The dual disclosure highlights concurrent risk in a widely used enterprise collaboration platform and raises the urgency for defenders to assess exposure across SharePoint environments.
Jun 29, 2026
Microsoft’s August security updates completed remediation of a two-vulnerability unauthenticated remote code execution chain in on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The chain combines `CVE-2026-55040`, an authentication bypass flaw patched in July with a CVSS score of 9.1, and `CVE-2026-63520`, the code-execution component patched in August. According to reporting cited by CERT Uganda, attackers can chain the flaws to forge a JSON Web Token, impersonate any SharePoint user or administrator, and gain full unauthenticated remote code execution. Active exploitation of `CVE-2026-55040` was confirmed in August, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with an urgent remediation deadline. The SharePoint fixes landed amid Microsoft’s July 2026 security release, which addressed a record 570 vulnerabilities including two actively exploited zero-days. Organizations that applied only the July SharePoint update remain exposed to the full attack chain until the August cumulative update is installed.
Aug 20, 2026
Microsoft released security updates for **SharePoint Server Subscription Edition**, **SharePoint Server 2019**, and **SharePoint Server 2016**, including corresponding language pack updates, to address actively exploited SharePoint vulnerabilities. The flaws include **`CVE-2025-53770`**, a critical unauthenticated remote code execution issue caused by unsafe deserialization of untrusted data, and **`CVE-2025-53771`**, a spoofing flaw tied to improper path validation for sensitive files; reporting linked their exploitation to the **ToolShell** campaign targeting government, academic, and energy organizations worldwide. Microsoft published update packages including **`KB5002768`** for Subscription Edition, **`KB5002754`** and **`KB5002753`** for SharePoint 2019 core and language pack, and **`KB5002760`** and **`KB5002759`** for SharePoint 2016 and its language pack. U.S. CISA also added a critical SharePoint deserialization flaw, **`CVE-2026-50522`**, to its **Known Exploited Vulnerabilities** catalog after public proof-of-concept code and reports of active attacks. According to the advisory, attackers have stolen SharePoint machine keys to preserve access even after patching, prompting guidance to patch immediately, rotate potentially exposed credentials and cryptographic material, enable protections such as **AMSI** and **Microsoft Defender AV**, and investigate systems for indicators of compromise including webshells, suspicious files, malicious URLs, paths, and IP addresses.
Aug 10, 2026