Loading story…
Microsoft disclosed CVE-2023-29357, an elevation-of-privilege vulnerability in Microsoft SharePoint Server 2019 that is being actively exploited in the wild. The flaw allows an unauthenticated attacker to send a forged JSON Web Token (JWT), bypass authentication, and obtain administrator-level access on a vulnerable SharePoint server.
Microsoft released fixes for the issue in its June 2023 security updates, and defenders have been urged to patch exposed SharePoint systems immediately. CSIRT.SK also noted that environments with AMSI integration enabled and Microsoft Defender deployed in SharePoint Server farms have protection against exploitation, but unpatched servers remain at risk of full administrative compromise.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA warned that CVE-2023-29357 was under active exploitation in the wild. The flaw can let an unauthenticated attacker gain administrator-level access to a vulnerable SharePoint server.
Microsoft released security updates for CVE-2023-29357 as part of its June 2023 Patch Tuesday updates. The vulnerability affects Microsoft SharePoint Server 2019 and can allow authentication bypass and privilege escalation via a forged JWT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-56164**, an elevation-of-privilege vulnerability in **Microsoft SharePoint Server** caused by missing authentication for a critical function. The flaw is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and Microsoft says exploitation has been detected in the wild. Reporting on the issue indicates attackers can abuse improper request validation in a SharePoint client service endpoint to bypass expected `X-RequestDigest` checks under certain routing conditions and obtain an elevated administrative security context. Successful exploitation can allow unauthorized takeover of site collections and farm configurations, data exfiltration, persistence through permission changes, and potential lateral movement into the wider Windows Server environment, particularly on internet-exposed SharePoint systems. Microsoft has released a security update and recommends enabling **AMSI integration** and full request-body scanning in SharePoint and IIS worker process memory; additional reporting also points to IIS URL Rewrite filtering of unauthenticated requests to the vulnerable client service endpoint as a temporary defensive measure.
Aug 31, 2026
Threat actors are actively exploiting **CVE-2026-55040**, a critical Microsoft SharePoint authentication bypass flaw with a **CVSS score of 9.1**, after public proof-of-concept code was released. The vulnerability, patched by Microsoft in July 2026, affects SharePoint Server Subscription Edition and allows unauthenticated attackers to forge JWTs, bypass authentication, and impersonate any SharePoint user, including administrators. Researchers said the bug chain stems from multiple weaknesses in SharePoint’s JWT validation pipeline, including acceptance of an outer token using `alg: none` and failures to properly verify certificate trust and token signatures. Security researchers and honeypot operators reported a sharp rise in exploitation attempts immediately after the PoC became public, with telemetry showing 12 attempts since July 19 and most activity concentrated on August 12 and 13. Successful attacks can expose documents, enable data modification across a SharePoint farm, and provide a foothold for broader compromise of connected Microsoft 365 environments, increasing urgency for organizations to apply Microsoft’s patch and review SharePoint access for signs of abuse.
Aug 13, 2026
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026