VulnerabilityBleeping Computer
8.8 — CRITICAL
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Ransomware gangs have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659) since early July, allowing attackers with low privileges to execute arbitrary code on unpatched servers.
⚙️Technical Details
💥Impact Assessment
Severity: Critical
Who Is at Risk
Federal civilian executive branch agencies and internet-exposed Microsoft SharePoint servers
🛡️Recommended Actions
1Apply Microsoft's latest patches for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition
2Enable Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications and use Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise
3Shorten patching cycles to minimize the attack window
📦Affected Products
Microsoft Sharepoint ServerMicrosoft Defender Antimalware Platform
🔐NVD Verified DataVERIFIED
CVE-2026-45659 ↗CVSS 8.8 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-502
Affected Products (CPE)
Microsoft Sharepoint Server
CVE-2026-33825 ↗CVSS 7.8 — HIGH
Attack Vector
LOCAL
Complexity
LOW
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-1220
Affected Products (CPE)
Microsoft Defender Antimalware Platform
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.