Tag
Microsoft Addresses Two Actively Exploited Zero-Day Vulnerabilities in July 2026 Patch Tuesday
8 TTPs 4 CVEs 8 IOCsMicrosoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, including two actively exploited zero-day elevation of privilege flaws, CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint, allowing local and remote attackers to gain administrative control.
Microsoft SharePoint Server RCE Vulnerability
2 rules 1 TTPAn authenticated remote attacker can exploit a vulnerability in Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint to execute arbitrary code.
CVE-2026-40368 - Microsoft Office SharePoint Deserialization Vulnerability
2 rules 1 TTP 1 CVECVE-2026-40368 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint, allowing an authorized attacker to execute code over a network.
CVE-2026-33110 - Microsoft SharePoint Deserialization Vulnerability
1 rule 1 TTP 1 CVECVE-2026-33110 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint, allowing an authorized attacker to achieve remote code execution over a network.
Critical Unauthenticated RCE Vulnerability Exploited in Microsoft SharePoint
2 rules 2 TTPsA remote code execution vulnerability in Microsoft SharePoint (CVE not specified) is being actively exploited by unauthenticated attackers, prompting urgent patching recommendations for internet-facing servers.
Active Exploitation of SharePoint Deserialization Vulnerability (CVE-2026-20963)
2 rules 1 TTPCVE-2026-20963, a SharePoint deserialization vulnerability, is under active exploitation and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate patching and auditing of potentially compromised data.
SharePoint Malware Upload for Lateral Movement
2 rules 2 TTPsAttackers can upload malware to SharePoint, leveraging the platform's file-sharing capabilities to propagate threats laterally within an organization and compromise additional systems.
SharePoint spinstall0.aspx Webshell Activity
2 rules 3 TTPsThis brief describes the detection of GET requests to the spinstall0.aspx webshell, commonly deployed after exploiting CVE-2025-53770 in Microsoft SharePoint, indicating potential command execution, data exfiltration, or credential harvesting.
SharePoint Sensitive Term Discovery via O365 Logs
2 rules 1 TTPAdversaries may search for sensitive terms within SharePoint to identify valuable data for exfiltration or further compromise, leaving traces in O365 audit logs.
M365 SharePoint/OneDrive File Access via PowerShell
2 rules 4 TTPsDetects file downloads and access from OneDrive or SharePoint using PowerShell-based user agents, which adversaries leverage with compromised OAuth tokens to exfiltrate data.
Entra ID Sharepoint or OneDrive Accessed by Unusual Client
2 rules 4 TTPsAn application accessing SharePoint Online or OneDrive for Business for the first time in a tenant could indicate OAuth phishing, illicit consent grants, or compromised third-party apps accessing file storage.
Spring Boot Actuator Misconfiguration Leads to Potential SharePoint Exfiltration via Stolen Credentials
2 rules 4 TTPs 1 IOCA threat actor can exploit a misconfigured Spring Boot Actuator to steal credentials and potentially exfiltrate data from SharePoint after bypassing MFA.
Microsoft SharePoint Server Elevation of Privilege via CVE-2023-29357
2 rules 1 TTPExploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357, involving specific API calls and HTTP methods, can lead to privilege escalation and unauthorized access to sensitive data within the SharePoint environment.