What Happened?
- CISA now flags a Microsoft SharePoint code execution bug as used in ransomware attacks, six weeks after it first added the flaw to the same catalog.
- Attackers who broke into SonicWall SMA1000 appliances took passwords, live session records, and the seed files that generate one-time MFA codes.
- Shadowserver counts more than 8,500 SharePoint servers reachable from the internet, and over 200 of them are still unpatched against the bug.
The U.S. Cybersecurity and Infrastructure Security Agency changed one field in its vulnerability catalog on Tuesday, and the change says more than the original listing did. CVE-2026-45659, a Microsoft SharePoint deserialization flaw, is now marked as known to be used in ransomware campaigns. When the agency added the bug on July 1 and gave federal civilian agencies three days to fix it, that same field read “Unknown.”
Reaching it is not difficult: CVSS 8.8, CWE-502, and only Site Member permissions on the target site. Microsoft called exploitation less likely when it shipped May fixes for SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition. The advisory still does not say it is being exploited.
Microsoft’s write-up spelled out how cheap the attack is. “The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component,” the company wrote in the update guidance.
CISA added 6 new vulnerabilities to the Known Exploited Vulnerabilities catalog targeting enterprise management planes, RMM tools, CI/CD pipelines, and AI orchestrators.
— HackerStorm (@hackerstorm) August 10, 2026
Active exploitation involves unauthenticated RCEs & auth bypasses across N-able N-central, JetBrains… pic.twitter.com/lhrpBbfvy7
The ransomware label arrives long after the ransomware
CISA gave SonicWall the same treatment two weeks later. CVE-2026-15409, an unauthenticated server-side request forgery hole in the SMA1000 Workplace interface, scores a full 10.0 and landed in the catalog on July 14 with a three-day deadline. That listing now carries the ransomware flag too.
The timeline underneath both entries is the story. Rapid7’s managed detection and response team found the SonicWall pair inside a live intrusion and reported them to the vendor. Volexity traced the campaign, which it tracks as UTA0533, back to June 22, three weeks before any advisory existed. By the time a bug reaches the catalog, the exploitation is old news. By the time the column flips, so is the ransomware.
It is the second Microsoft flaw this summer to get the flag while Microsoft stays quiet: CVE-2026-33825, the Defender escalation bug known as BlueHammer, was tied to ransomware in June and still carries no exploited tag. Since November 2021, CISA has listed 14 SharePoint vulnerabilities, eight of them tied to ransomware.
Patching the SMA1000 leaves the stolen credentials behind
The SonicWall chain runs in two moves. An attacker hits the /wsproxy endpoint to open a websocket tunnel into services meant to be reachable only from localhost, then abuses a path-traversal remove_hotfix workflow on port 8188 to run commands as root. That second step is CVE-2026-15410, a CVSS 7.2 code injection issue filed under CWE-94.
What the intruders did next is why a patch ticket does not close this out. Rapid7 documented theft of “high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations,” followed by pivots to domain controllers. Volexity watched the same operators run tcpdump against unencrypted LDAP traffic and deploy tooling it named ROOTRUN, KNUCKLEBALL, suo5 and ORANGETAIL. “With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances,” Volexity wrote.
Anyone who ran a 6210, 7210 or 8200v through July has work beyond the hotfix. The fixed builds are 12.4.3-03453 and later, or 12.5.0-02835 and later, and SonicWall’s advisory lists three log checks:
- Successful HTTP 200 requests to /__api__/login or /__api__/logout in extraweb_access.log, routes that are not part of a legitimate configuration.
- /wsproxy requests carrying suspicious host parameters that returned HTTP 101.
- Hotfix rollback events with path-traversal-style names in ctrl-service.log.
If any of those land, SonicWall says treat the appliance as fully compromised: re-image or redeploy it, change every user and administrator password, and reset TOTP tokens. That work helps reduce the risk of a return trip on harvested material. It does not prove the operators are gone.
What the flag does not tell you?
CISA’s ransomware marker names no family, counts no incidents, and gives no start date. Other researchers have filled part of that gap on the SonicWall side. Resecurity has named INC Ransomware as the dominant actor working the flaw, and Ransomware.Live puts the group’s claimed victim count at 885, with a listing as recent as August 2. Nobody has publicly named a family behind the SharePoint exploitation.
That leaves open questions worth tracking. Which crews are running CVE-2026-45659, and are they buying the access or building it? How many of the 200-plus unpatched SharePoint servers are already backdoored? Will Microsoft revise either advisory?
What to expect next?
Both federal deadlines have passed, so the near-term signal is Shadowserver’s unpatched count. CISA’s hardening guidance for SharePoint operators still stands: turn on Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications, run Microsoft Defender Antivirus detections, verify that patches actually installed, and shorten patch cycles. BOD 26-04 forensic triage requirements govern how affected federal assets get cleared.
Expect more edge-appliance entries to pick up the flag on the same lag. The Cisco firewall patch scramble, the Microsoft Exchange hybrid vulnerability, Warlock’s Colt outage and data theft and the crew tracked as The Gentlemen all ran through internet-facing enterprise software. The KEV ransomware field records what already happened to somebody else. Read as an early warning, it is yesterday’s incident report.
