CISA Urges Immediate Patching as Multiple SharePoint Server Vulnerabilities Confirmed Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that multiple vulnerabilities in Microsoft SharePoint Server are being actively exploited and is urging organizations to apply security updates without delay.
CISA highlighted four vulnerabilities for which exploitation has been confirmed: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. The last of these was added to the Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, prompting its inclusion in the advisory. In addition, Microsoft has warned that CVE-2026-55040, although not yet confirmed as exploited, poses a high risk if left unpatched.
Exploitation of these flaws can allow attackers to execute arbitrary code remotely. Consequences include theft of machine keys from Internet Information Services (IIS), creation of persistent access mechanisms, and deployment of malware within affected environments.
CISA emphasized that organizations running SharePoint Server should immediately install the latest patches released by Microsoft and verify that the updates have been applied successfully. In addition to patching, administrators must confirm that the Antimalware Scan Interface (AMSI) is enabled and actively monitor systems using Microsoft Defender Antivirus (MDAV) for any signs of exploitation or anomalous activity.
Any detection events generated by AMSI or MDAV should trigger the organization’s incident response plan. Recovery steps include removing malicious programs, restoring systems from a known-good state, and rotating cryptographic keys that may have been compromised.
CISA further recommended that, unless there is a compelling operational reason, SharePoint Server instances should not be exposed directly to the internet. Organizations should instead place servers behind a Layer 7 reverse proxy that provides authentication and validation, block external access to administrative interfaces, and strengthen log monitoring to detect potential attacks.
Related articles
Automated Pentesting and BAS: How AI Systems Like XBOW Outpace Human Researchers in Vulnerability Discovery
The article explores how automated penetration testing and Breach and Attack Simulation tools have evolved to provide continuous validation of security controls beyond annual manual pentests. It explains the distinction between BAS, which tests individual attack techniques against security tools using frameworks like MITRE ATT&CK, and autopentest solutions that build complete attack paths to critical assets. Russian vendor Positive Technologies released PT Dephaze 3.0 in October 2025, incorporating machine learning for controlled internal pentesting and earning the National Runet Award. Globally, AI-driven systems demonstrated superior performance, with XBOW topping HackerOne rankings by discovering over 1,000 vulnerabilities including 54 critical ones in just 90 days. Google’s Big Sleep project, combining DeepMind and Project Zero, identified and helped patch CVE-2025-6965 in SQLite before widespread exploitation. These developments underscore the need to integrate automated validation into vulnerability management processes under the emerging CTEM framework.
Critical SSRF Vulnerability Affects SonicWall SMA1000 Series Remote Access Appliances
SonicWall has disclosed four vulnerabilities in its SMA1000 series remote access products, with one rated critical. The most severe issue, CVE-2026-102255, is a server-side request forgery flaw in the WorkPlace interface that allows unauthenticated attackers to abuse the appliance as a forward proxy and reach internal functions. The vulnerability received the maximum CVSSv3.0 base score of 10.0. Two additional flaws, CVE-2026-102256 and CVE-2026-102257, enable authenticated OS command injection and unauthenticated path traversal via crafted archives, respectively. No exploitation has been observed in the wild at the time of disclosure. SonicWall has released updates to address all issues.
WordPress 7.1.3 Security Release Fixes Seven Vulnerabilities Including Stored XSS and SQL Injection
The WordPress development team has released version 7.1.3 as a maintenance and security update addressing multiple vulnerabilities. The release includes seven security fixes and four additional bug corrections. Among the security issues resolved is a stored cross-site scripting flaw that allowed pending comments to execute scripts in the administrative interface. Other fixes cover a denial-of-service condition in URL handling, an SQL injection vulnerability in the WXR export feature, and unauthorized disclosure of comments attached to private or unpublished posts. Additional patches address an XSS issue in the Imgur embed functionality, improper sticky post permissions for users with the Author role, and a parameter manipulation problem affecting hook action names.
Google Releases Chrome 155 Fixing 247 Vulnerabilities Including Four Critical Use-After-Free Flaws
Google has released Chrome 155 on October 6, 2026, addressing a total of 247 security issues across Windows, macOS, and Linux platforms. The update includes four critical vulnerabilities, all classified as use-after-free flaws that affect Chromecast, Browser, Navigation, and Track components. Fifty-three high-severity issues were also resolved, covering problems in SiteIsolation, Core, Omnibox, FileSystem, ANGLE, WebGL, and multiple other modules. The critical CVEs fixed are CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347. Additional fixes address use-after-free conditions, race conditions, type confusion, and integer overflows in V8, WebRTC, PDF, Media, Parser, Storage, and WebAudio. The new versions are Chrome 155.0.8059.40 for Windows and macOS and 155.0.8059.39 for Linux and macOS.