Loading story…
Microsoft addressed CVE-2025-49704, a remote-code-execution vulnerability in SharePoint Server, but subsequent research showed that the initial remediation could be bypassed. The flaw became part of the SharePoint attack path commonly tracked as ToolShell, in which attackers could execute code on vulnerable on-premises servers.
Netlas highlighted the incident as an example of patch bypass risk: applying a vendor update may not fully remove an underlying vulnerable condition when the fix is incomplete. Organizations running SharePoint Server should verify that they have deployed Microsoft’s superseding security updates, review internet-exposed SharePoint assets, and investigate for indications of compromise rather than treating the original patch alone as sufficient remediation.
See which actors are running it and whether you're in range.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s August security updates completed remediation of a two-vulnerability unauthenticated remote code execution chain in on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The chain combines `CVE-2026-55040`, an authentication bypass flaw patched in July with a CVSS score of 9.1, and `CVE-2026-63520`, the code-execution component patched in August. According to reporting cited by CERT Uganda, attackers can chain the flaws to forge a JSON Web Token, impersonate any SharePoint user or administrator, and gain full unauthenticated remote code execution. Active exploitation of `CVE-2026-55040` was confirmed in August, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with an urgent remediation deadline. The SharePoint fixes landed amid Microsoft’s July 2026 security release, which addressed a record 570 vulnerabilities including two actively exploited zero-days. Organizations that applied only the July SharePoint update remain exposed to the full attack chain until the August cumulative update is installed.
Aug 20, 2026
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Aug 25, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Aug 15, 2026