8 posts
A critical deserialization vulnerability (CVE-2026-45659) in Microsoft SharePoint Server is being actively exploited, enabling remote code execution by low-privileged attackers. The flaw affects SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition, with fixed versions available. CISA added this CVE to its KEV catalog on July 1, 2026, and the Canadian Cyber Centre urges immediate patching, especially for internet-exposed on-premises deployments.
A critical vulnerability in the Google Cloud Vertex AI SDK for Python allows attackers to achieve cross-tenant Remote Code Execution (RCE) via bucket squatting. By predicting default staging bucket names and exploiting a lack of ownership verification, attackers can intercept model uploads and inject malicious pickle payloads, leading to the theft of highly privileged service account tokens.
Check Point Research discovered critical vulnerabilities in LangGraph's SQLite and Redis checkpointers that allow attackers to chain SQL injection with unsafe msgpack deserialization to achieve Remote Code Execution (RCE). The flaws occur when user-controlled input is passed to the getstatehistory() filter, enabling attackers to inject malicious serialized payloads that execute arbitrary OS commands upon deserialization.
CISA has added CVE-2026-45247, a deserialization of untrusted data vulnerability affecting the Mirasvit Full Page Cache Warmer, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation, and CISA strongly urges all organizations to prioritize its remediation to reduce exposure to cyberattacks.
In March 2026, 31 high-impact vulnerabilities were actively exploited, highlighted by the Interlock Ransomware Group leveraging a CVSS 10.0 zero-day in Cisco Secure FMC (CVE-2026-20131). The attackers utilized insecure Java deserialization to gain root access, deploying custom RATs, memory-resident web shells, and ransomware across enterprise networks.
CERT-EU issued an urgent security advisory regarding CVE-2026-20963, a critical unauthenticated remote code execution vulnerability in Microsoft SharePoint caused by the deserialization of untrusted data. The flaw is actively being exploited in the wild, prompting strong recommendations to immediately patch internet-facing servers, enable AMSI, and rotate ASP.NET machine keys.
CISA has added CVE-2026-20131, a deserialization of untrusted data vulnerability affecting Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC), to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
CISA has added CVE-2026-20963, a Microsoft SharePoint Deserialization of Untrusted Data Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Organizations are strongly urged to prioritize timely remediation of this flaw as part of their vulnerability management practices to reduce exposure to cyberattacks.
