The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild. The post SharePoint Vulnerability Exploited Shortly After PoC Release appeared first on SecurityWeek .
A critical authentication bypass vulnerability (CVE-2026-55040) in Microsoft SharePoint has been exploited using a proof-of-concept exploit published by Rapid7. The flaw allows attackers without privileges to impersonate SharePoint users or administrators, potentially disclosing files and modifying data. Microsoft patched this vulnerability in the July 2026 Patch Tuesday updates for SharePoint Enterprise Server 2016 and SharePoint Server 2019. Although exploit code is being used in attacks, there is no confirmed widespread exploitation in the wild. CISA has issued guidance to secure SharePoint servers, including limiting Internet exposure and applying Microsoft's security hardening recommendations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]
Discover how Tenable Hexa AI closes the gap between exposure management and endpoint patching using intent-driven routines, smart guardrails, and human approval. Key takeaways The problem: A slow handoff between security workflows creates a days-long remediation gap. The solution: Tenable Hexa AI bridges this gap using intent-driven Routines that automate scoping, deployment, and verification across integrated platforms like Jamf. Safety and control: Autonomy is governed by the harness built into Tenable One, ensuring the AI operates strictly within defined user permissions and guardrails. Find the exposure. Fix it. Confirm it is gone. Those three steps are rarely executed in a single place, by a single team. Exposure management knows which assets are at risk, while endpoint management actually changes the machine and applies the fix. Between those two domains of exposure identification and remediation lies a slow, manual handoff and multi-step routine that costs security teams days or weeks while vulnerabilities remain exposed: Scope the asset group Aim the remediation policy Execute patch deployment Check status Re-scan the environment to confirm the finding was closed. Tenable Hexa AI , the agentic engine of the Tenable One Exposure Management Platform , now spans that handoff, so you don’t have to manually toggle among tools or continually restart the conversation. How does Tenable Hexa AI autonomously close the remediation loop Say there’s an actively exploited Chrome vulnerability, and a fleet of your Macs is still running the vulnerable version. Rather than navigating multiple tools, you simply tell Tenable Hexa AI to patch it. Tenable Hexa AI executes the workflow in three unified stages: Enumeration and mapping - Tenable Hexa AI enumerates the affected assets across your exposure sources and resolves them to the devices your endpoint team already manages in Jamf. Policy identification - Tenable Hexa AI maps the CVE to the version that fixes it, then finds the Jamf patch definition that delivers that version. Proposal presentation - Before writing any changes, Tenable Hexa AI stops and shows you a proposal detailing the number of devices, which devices, what policy, and what the deployment window looks like. It highlights the blast radius and it tells you plainly that the action does not roll itself back. If you need to narrow enumeration to one business unit, just tell Hexa and it will re-scope and return a new plan before executing any changes. Once you approve, Tenable Hexa AI creates a static group in Jamf holding exactly the devices you approved, then triggers the policy against it. Ask Hexa for status at any point, and it returns the rollout device by device, without you leaving the chat window. Tenable Hexa AI then schedules a re-scan for after the patch deployment window. What previously took days across multiple tools now takes minutes within a single conversation, and all you need to do is make one decision rather than coordinate the manual execution of multiple, complex steps. Hand off recurring security work to intent-driven routines The ultimate goal of agentic AI for security is to help security teams efficiently and effectively scale cyber defense by taking on complex manual routines. To carry out vulnerability remediation and validation routines with Tenable Hexa AI, you define three core elements in plain, natural language: An objective - State what you are trying to achieve, in the words you would use with a colleague, not a sequence of steps (e.g., “Triage and patch critical vulnerabilities across MacOS endpoints”). Guardrails - Set explicit operational limits (e.g., “Never launch a credentialed scan against anything tagged OT,” or “Open no more than twenty-five tickets in a run”). A cadence - Choose whether to run the routine on demand or tell Hexa to run it on a specific schedule. Tenable Hexa AI drafts the plan using capabilities discovered from the tools you have already connected to Tenable One.…
The INC Ransomware gang has been targeting vulnerable SMA1000 appliances for root access and lateral movement. The post Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks appeared first on SecurityWeek .
The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations. The post Unpatched Fastjson Vulnerability Exploited in Attacks appeared first on SecurityWeek .
Impacting on-premises deployments, the OS command injection allows attackers to access privileged internal functionality. The post Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day appeared first on SecurityWeek .
Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]
A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]
The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents. [...]
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances. [...]
The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server. The post Fresh SharePoint Vulnerability Exploited Soon After Disclosure appeared first on SecurityWeek .
Two critical vulnerabilities in Fortinet FortiSandbox were actively exploited in the wild, allowing unauthenticated remote code execution via command injection. Fortinet released patches for these flaws in April and June 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to prioritize patching by July 19, 2026. These vulnerabilities have been observed exploited in attacks, including by threat intelligence sources and confirmed by CISA. Fortinet has a history of vulnerabilities exploited in espionage and ransomware campaigns.
CISA has ordered federal agencies to secure their systems by Saturday against ongoing attacks exploiting a critical vulnerability in the Oracle E-Business Suite financial application. [...]
The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability. The post Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day appeared first on SecurityWeek .
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. [...]