CISA: Microsoft SharePoint RCE flaw now actively exploited
Source Bleeping Computer
Mentioned vulnerabilities
Rated High by Bleeping Computer
Data as of 3 Jul 2026, 01:20 UTC
What to do
AI-suggested
Microsoft has released official security updates addressing this vulnerability for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition as of May 21, 2026. Organizations should apply these patches immediately to mitigate the risk. CISA mandates U.S. federal agencies to patch affected systems promptly under Binding Operational Directive 26-04. If patching is not immediately possible, organizations should follow applicable BOD 26-04 guidance for mitigating exposure or consider discontinuing use of the affected product. No alternative mitigations or workarounds are specified in the advisory.
Description
CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May. [...]