Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Fresh SharePoint Vulnerability Exploited Soon After Disclosure The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server. The post Fresh SharePoint Vulnerability Exploited Soon After Disclosure appeared first on SecurityWeek . Fresh SharePoint Vulnerability Exploited Soon After Disclosure - SecurityWeek Virtual Event Today: Cloud & Data Security Summit - Join Event In-Progress SECURITYWEEK NETWORK: Cybersecurity New…

https://www.securityweek.com/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure

sha256:472ce92acf7938c807b45425851accf9ff74be8420e5ad7a69b5aac24a48630a

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve5
md50
url0
ipv40
ipv60
sha10
domain0
sha2560
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-39808	Open →
cve	CVE-2026-25089	Open →
cve	CVE-2026-56164	Open →
cve	CVE-2026-55040	Open →
cve	CVE-2026-58644	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Scattered Spider

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports