Tag Archives: Rapid7

About Authentication Bypass - Microsoft SharePoint (CVE-2026-55040) vulnerability

Leave a reply

About Authentication Bypass - Microsoft SharePoint (CVE-2026-55040) vulnerability

About Authentication Bypass - Microsoft SharePoint (CVE-2026-55040) vulnerability. SharePoint is a web application for corporate intranet portals, document management, and collaboration. This vulnerability was disclosed as part of the July Microsoft Patch Tuesday. A remote unauthenticated attacker can leverage this vulnerability to bypass authentication on a vulnerable SharePoint server and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline. A JWT (JSON Web Token) is essentially an "electronic pass" that SharePoint uses to determine who a user is and what actions they are authorized to perform. When combined with CVE-2026-63520, the vulnerability allows an attacker to perform remote code execution on a SharePoint server without authentication, with the privileges of the SharePoint service account. As a result, an attacker can gain access to documents and other organizational data stored in SharePoint, modify or delete them, extract credentials, install malware, and establish persistence in the system, and then use the compromised server for further penetration into the organization's internal network.

🛠 The vulnerability was discovered by Stephen Fewer from Rapid7 during SharePoint research conducted in January and March 2026. The research aimed to develop an exploit for the Pwn2Own Berlin competition. AI tools and agentic workflows were actively used throughout the research. Rapid7 published a detailed analysis of the vulnerability and the exploit code on its blog on August 11.

👾 According to VulnCheck, exploitation attempts were detected on honeypots shortly after the exploit was published. The vulnerability was added to the VulnCheck KEV on August 12 and to the CISA KEV on August 18.

⚙️ Updates are available for Microsoft SharePoint Server 2016 (Enterprise), 2019, and Subscription Edition. Note that you need to install the latest SharePoint cumulative updates that include fixes for CVE-2026-55040 and CVE-2026-63520.

🌐 As of August 25, 2026, Censys experts reported around 21,000 on-premises SharePoint installations exposing their version information. According to The Shadowserver Foundation, around 8,500 SharePoint servers were accessible from the Internet each day in September 2026. These are observed servers, and not all of them are necessarily vulnerable. No statistics on vulnerable servers are available.

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability

Leave a reply

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability. TeamCity is a proprietary solution developed by JetBrains for automating software build, testing, and deployment processes. TeamCity uses a central server to coordinate builds and separate build agents to execute them. An agent can communicate with the server through the agent polling protocol: it registers with the server, requests the next command, and reports whether the command succeeded or failed. The vulnerability allows an unauthenticated remote attacker with HTTP(S) access to a TeamCity On-Premises server to execute arbitrary operating system commands with the privileges of the TeamCity Server process through the agent polling protocol. The vulnerability is caused by insecure deserialization of XML data (CWE-502). Depending on the privileges of the TeamCity Server process, successful exploitation may allow an attacker to access TeamCity data, configurations, and stored credentials, modify the server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.

⚙️ A notice about this critical vulnerability was published on the JetBrains blog on July 27. The vulnerability affects all versions of TeamCity On-Premises. To remediate the vulnerability, users should upgrade to version 2025.11.7 or 2026.1.3. As a compensating measure, a security patch plugin can be installed on TeamCity 2017.1 and later to prevent exploitation of the vulnerability. For TeamCity 2017.1-2018.1, the server must be restarted after installing the plugin. Starting with TeamCity 2018.2, the plugin can be enabled without restarting the TeamCity server. As a longer-term security measure, the vendor recommends limiting network access to TeamCity servers to trusted networks, including restricting access to the TeamCity login page and REST API. It is also recommended to run the TeamCity server under an operating system account with the minimum privileges required for normal operation. TeamCity servers should be deployed on dedicated hosts separate from build agents, as described in the documentation.

👾 The vulnerability was added to the CISA KEV on August 5. On August 7, JetBrains published a report confirming exploitation of the vulnerability in the wild. The vendor recommended checking TeamCity logs for com.thoughtworks.xstream.converters.ConversionException messages, which may indicate successful exploitation of the vulnerability and warrant further investigation. After updating the server or installing the security patch plugin, logs can be checked for com.thoughtworks.xstream.security.ForbiddenClassException messages, which indicate that an exploitation attempt was blocked. Unauthorized build agents, particularly those with names beginning with scan, may also indicate exploitation attempts.

🛠 A technical analysis of the vulnerability and a link to a public exploit were published on the Rapid7 blog on August 7. A Metasploit module for simplified exploitation of the vulnerability has been available since August 28.

🌐 According to JetBrains, TeamCity is used by more than 30,000 organizations worldwide across government, technology, financial services, healthcare, and other sectors, including some Fortune 500 companies. As of July 30, Censys had detected approximately 4,500 TeamCity installations exposed to the Internet. Of these, 450 were running versions 2025.11.7 or 2026.1.3. Most of the remaining installations were running earlier versions or did not disclose version information.

August Microsoft Patch Tuesday

Leave a reply

August Microsoft Patch Tuesday

August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild:

🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). A local attacker can exploit this vulnerability to gain SYSTEM-level privileges. There is a contradiction in Microsoft's description: the Exploit Code Maturity in CVSS is marked as "Unproven", while at the same time Microsoft states that the vulnerability is being exploited in the wild. 🤷‍♂️

Public exploits are available for two other vulnerabilities:

🔸 EoP - Windows User Profile Service (CVE-2026-62832). This vulnerability allows an authenticated attacker to elevate privileges to ADMINISTRATOR level. Rapid7 believes this vulnerability is related to the LegacyHive exploit, which was published on July 14.

🔸 EoP - Windows Kernel (CVE-2026-62737). This vulnerability allows an authenticated attacker to elevate privileges to SYSTEM level. An exploit has been publicly available since August 11.

Among the remaining vulnerabilities, the following stand out:

🔹 RCE - Windows DNS Server (CVE-2026-62878). This wormable vulnerability allows a remote unauthenticated attacker to execute code on a vulnerable server with elevated privileges. It is recommended to test and install the update as soon as possible, especially on Internet-facing DNS servers.

🔹 RCE - Windows Deployment Services TFTP Server (CVE-2026-62893). This vulnerability, discovered as part of the ZDI (Zero Day Initiative) program, allows an attacker to execute code without authentication or user interaction. TFTP has no authentication mechanism and is available remotely via UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP, which is the standard PXE boot scenario, is vulnerable. The issue results from the lack of validation of the existence of an object before performing operations on it. UDP port 69 should be blocked at the perimeter, but attackers could easily use this vulnerability for lateral movement within an organization. If you're using WDS for deployments, test and install this update quickly.

🔹 RCE - Windows DHCP Server (CVE-2026-62823). Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code from an adjacent network by sending a specially crafted packet that triggers a heap-based buffer overflow.

🔹 EoP - Microsoft Exchange (CVE-2026-62911). This vulnerability allows a remote authenticated attacker (with Privileges Required: Low according to CVSS) to gain control over the mailboxes of all Exchange users, send and read emails, and download attachments. This vulnerability was demonstrated at Pwn2Own Berlin. ZDI researchers provided Microsoft with working exploits.

🔹 RCE - Microsoft QUIC (CVE-2026-62815). This use-after-free vulnerability allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted network packet. QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP and serves as the foundation for HTTP/3. The protocol is used by approximately 13.5 million websites.

🔹 Tampering - Windows Container Isolation FS Filter Driver (unionfs.sys) (CVE-2026-72971). This vulnerability reportedly allows an attacker to overwrite certain files. As a result, an attacker could perform an action within a container that could impact the host system.

🗒 Full Vulristics report

Microsoft Patch Tuesday July 2023: Vulristics improvements, Office RCE, SFB SmartScreen and Outlook, EoP MSHTML and ERS, other RCEs

1 Reply

Microsoft Patch Tuesday July 2023: Vulristics improvements, Office RCE, SFB SmartScreen and Outlook, EoP MSHTML and ERS, other RCEs. Hello everyone! This episode will be about Microsoft Patch Tuesday for July 2023, including vulnerabilities that were added between June and July Patch Tuesdays.

Alternative video link (for Russia): https://vk.com/video-149273431_456239131

As usual, I use my open source Vulristics project to analyse and prioritize vulnerabilities.

Continue reading →

Microsoft Patch Tuesday August 2022: DogWalk, Exchange EOPs, 13 potentially dangerous, 2 funny, 3 mysterious vulnerabilities

Leave a reply

Microsoft Patch Tuesday August 2022: DogWalk, Exchange EOPs, 13 potentially dangerous, 2 funny, 3 mysterious vulnerabilities. Hello everyone! In this episode, let’s take a look at the Microsoft Patch Tuesday August 2022 vulnerabilities. I use my Vulristics vulnerability prioritization tool as usual. I take comments for vulnerabilities from Tenable, Qualys, Rapid7, ZDI and Kaspersky blog posts. Also, as usual, I take into account the vulnerabilities added between the July and August Patch Tuesdays.

Alternative video link (for Russia): https://vk.com/video-149273431_456239098

There were 147 vulnerabilities. Urgent: 1, Critical: 0, High: 36, Medium: 108, Low: 2.

There was a lot of great stuff this Patch Tuesday. There was a critical exploited in the wild MSDT DogWalk vulnerability, 3 critical Exchange vulnerabilities that could be easily missed in prioritization, 13 potentially dangerous vulnerabilities, 2 funny vulnerabilities and 3 mysterious ones. Let’s take a closer look.

Continue reading →

Vulnerability Management news and publications #2

1 Reply

Vulnerability Management news and publications #2. Hello everyone! This is the second episode of Vulnerability Management news and publications. In fact, this is a collection of my posts from the avleonovcom and avleonovrus telegram channels. Therefore, if you want to read them earlier, subscribe to these channels.

The main idea of ​​this episode. Microsoft is a biased company. In fact, they should now be perceived as another US agency. Does this mean that we need to forget about Microsoft and stop tracking what they do? No, it doesn’t. They do a lot of interesting things that can at least be researched and copied. Does this mean that we need to stop using Microsoft products? In some locations (you know which ones) for sure, in some we can continue to use such products if it is reasonable, but it’s necessary to have a plan B. And this does not only apply to Microsoft. So, it’s time for a flexible approaches. Here we do it this way, there we do it differently. It seems that rather severe fragmentation of the IT market is a long-term trend and it’s necessary to adapt to it.

Alternative video link (for Russia): https://vk.com/video-149273431_456239097

What’s in this episode:

  1. Microsoft released a propaganda report, what does this mean for us?
  2. Microsoft released the Autopatch feature, is it a good idea to use it?
  3. Ridiculous Vulnerability: Hardcoded Password in Confluence Questions
  4. The new Nessus Expert and why it’s probably Tenable’s worst release
  5. Rapid7 Nexpose/InsightVM features added in Q2 2022: what’s good and what’s weird
  6. Palo Alto: Malicious scan 15 minutes after CVE is released. Oh really?
  7. 6 groups of vulnerabilities that are most often used in attacks, according to Palo Alto, and the end of IT globalization

Continue reading →

Microsoft Patch Tuesday April 2022 and custom CVE comments sources in Vulristics

Leave a reply

Microsoft Patch Tuesday April 2022 and custom CVE comments sources in Vulristics. Hello everyone! This episode will be about Microsoft Patch Tuesday for April 2022 and new improvements in my Vulristics project. I decided to add more comment sources. Because it’s not just Tenable, Qualys, Rapid7 and ZDI make Microsoft Patch Tuesday reviews, but also other security companies and bloggers.

Alternative video link (for Russia): https://vk.com/video-149273431_456239085

You can see them in my automated security news telegram channel avleonovnews after every second Tuesday of the month. So, now you can add any links with CVE comments to Vulristics.

Continue reading →