#microsoft-sharepoint-zero-day
#microsoft-sharepoint-zero-day
[ follow ]
#cybersecurity #vulnerabilities #remote-code-execution #malware #microsoft #vulnerability #adobe #patch-tuesday
fromThe Hacker News
2 days agoShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers
[In] ShowDoc version before 2.8.7, an unrestricted and unauthenticated file upload issue is found and [an] attacker is able to upload a web shell and execute arbitrary code on server.
Information security
fromFinbold
1 day agoKraken insider extortion reveals remote work security blind spot
"Shortly after access was terminated, we began receiving extortion demands. The criminals threatened to distribute materials from both the February 2025 incident and the recent incident to media outlets and on social media if we did not comply. We will not pay these criminals," Percoco stated.
Information security
fromThe Hacker News
2 weeks agoNew Chrome Zero-Day CVE-2026-5281 Under Active Exploitation - Patch Released
"Use-after-free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page."
Information security
Information security
fromTheregister
3 weeks agoUnknown attackers exploit another critical SharePoint bug
Unknown attackers are actively exploiting CVE-2026-20963, a critical Microsoft SharePoint deserialization vulnerability that enables unauthenticated remote code execution, prompting CISA to mandate federal agency patching within three days.
Information security
fromSecurityWeek
3 weeks agoCISA Warns of Attacks Exploiting Recent SharePoint Vulnerability
Microsoft SharePoint vulnerability CVE-2026-20963, a critical remote code execution flaw, is being exploited in the wild despite Microsoft's assessment indicating exploitation is less likely.
fromThe Hacker News
1 month agoMicrosoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days
This month, over half (55%) of all Patch Tuesday CVEs were privilege escalation bugs, and of those, six were rated exploitation more likely across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon. We know these bugs are typically used by threat actors as part of post-compromise activity, once they get onto systems through other means (social engineering, exploitation of another vulnerability).
Information security
Information security
fromTheregister
1 month agoCritical Microsoft Excel bug weaponizes Copilot Agent
March's Microsoft Patch Tuesday released 83 CVEs with only two publicly known and none under active exploitation, including a critical zero-click Excel vulnerability that weaponizes Copilot Agent to exfiltrate data.
#zero-day-vulnerabilities
Information security
fromTechCrunch
1 month agoGoogle says half of all zero-days it tracked in 2025 targeted buggy enterprise tech | TechCrunch
Nearly half of tracked zero-day vulnerabilities in 2024 targeted enterprise devices, with security infrastructure like firewalls and VPNs being primary targets for hackers seeking corporate data access.
Information security
fromTechCrunch
1 month agoGoogle says half of all zero-days it tracked in 2025 targeted buggy enterprise tech | TechCrunch
Nearly half of tracked zero-day vulnerabilities in 2024 targeted enterprise devices, with security infrastructure like firewalls and VPNs being primary targets for hackers seeking corporate data access.
Information security
fromTechCrunch
2 months agoMicrosoft says hackers are exploiting critical zero-day bugs to target Windows and Office users | TechCrunch
Microsoft released fixes for actively exploited Windows and Office zero-day vulnerabilities that enable one-click remote code execution and malware installation.
Information security
fromTechzine Global
1 month agoMicrosoft closes Teams leak that allowed access without authentication
A critical improper access control vulnerability in Microsoft Teams allowed unauthenticated attackers to obtain network information; Microsoft resolved it server-side with no user action required.
[ Load more ]