Loading story…
Microsoft released security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, including corresponding language pack updates, to address actively exploited SharePoint vulnerabilities. The flaws include CVE-2025-53770, a critical unauthenticated remote code execution issue caused by unsafe deserialization of untrusted data, and CVE-2025-53771, a spoofing flaw tied to improper path validation for sensitive files; reporting linked their exploitation to the ToolShell campaign targeting government, academic, and energy organizations worldwide. Microsoft published update packages including KB5002768 for Subscription Edition, KB5002754 and KB5002753 for SharePoint 2019 core and language pack, and KB5002760 and KB5002759 for SharePoint 2016 and its language pack.
U.S. CISA also added a critical SharePoint deserialization flaw, CVE-2026-50522, to its Known Exploited Vulnerabilities catalog after public proof-of-concept code and reports of active attacks. According to the advisory, attackers have stolen SharePoint machine keys to preserve access even after patching, prompting guidance to patch immediately, rotate potentially exposed credentials and cryptographic material, enable protections such as AMSI and Microsoft Defender AV, and investigate systems for indicators of compromise including webshells, suspicious files, malicious URLs, paths, and IP addresses.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-50522, a critical Microsoft SharePoint deserialization flaw, to its Known Exploited Vulnerabilities catalog. The reporting says the flaw was being actively exploited after a public proof-of-concept release and that attackers were reportedly stealing SharePoint machine keys for persistence after patching.
CSIRT.SK reported that the exploited SharePoint flaws were used in a campaign dubbed ToolShell against dozens of government, academic, and energy institutions worldwide. The notice also published indicators of compromise including webshell, file, URL, path, and IP indicators tied to the attacks.
Microsoft released security updates for SharePoint Subscription Edition, SharePoint 2019, and SharePoint 2016 to fix CVE-2025-53770 and CVE-2025-53771, which were described as actively exploited vulnerabilities. The updates include packages for SharePoint Server 2016, SharePoint Server 2016 Language Pack, SharePoint Server 2019 Core, SharePoint Server 2019 Language Pack, and SharePoint Server Subscription Edition.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcegovcert.bg
Open sourcecsirt.sk
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft issued emergency guidance after attackers exploited zero-day flaws in on-premises **Microsoft SharePoint Server** in campaigns that hit businesses and at least some U.S. government agencies. In one wave, researchers tracked a variant of `CVE-2025-49706` dubbed **"ToolShell,"** warning it could grant full access to SharePoint file systems and connected Microsoft services such as Teams and OneDrive. Microsoft said **SharePoint Online** was not affected, while fixes were released for SharePoint Server 2019 and Subscription Edition and a SharePoint Server 2016 patch was still pending at the time of reporting. U.S. CISA later added another actively exploited SharePoint zero-day, `CVE-2026-32201`, to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to remediate it under **BOD 22-01**. Security firms including Eye Security, CrowdStrike, Google Threat Intelligence Group, and Palo Alto Networks warned that internet-facing SharePoint deployments in government, education, healthcare, and large enterprises face elevated risk, with defenders urged to patch quickly, isolate exposed servers if needed, rotate cryptographic material, and engage incident response support where compromise is suspected.
Jun 29, 2026
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Aug 27, 2026
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Aug 25, 2026