Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.
Stories tagged: #sharepoint
CISA adds SharePoint CVE-2026-56164 to KEV, chained with two prior bugs
CISA added SharePoint auth-bypass CVE-2026-56164 to KEV on July 14 and re-issued a hardening alert citing three chained on-prem SharePoint CVEs under active exploitation. FCEB deadline July 17.
CISA adds SharePoint CVE-2026-45659 to KEV, FCEB deadline July 4
CISA added SharePoint RCE CVE-2026-45659 to the KEV catalog on July 1 after confirmed exploitation. Deserialization bug patched OOB May 21; FCEB agencies have three days.