Tag

Deserialization

All articles tagged with #deserialization

cyber-security21 days ago•26 min saved

Entra ID RCE Flaw Prompts Cloud Security Scrutiny as Patch Goes Server‑Side

Microsoft disclosed a critical remote code execution vulnerability in Entra ID (CVE-2026-69836) caused by deserialization of untrusted data (CWE-502) that could allow unauthenticated attackers to run arbitrary code on the identity service. Microsoft has deployed a server-side patch with no customer action required; initial reports of in‑the‑wild exploitation are now clarified as not currently active. Security teams should still review Entra ID sign-in logs, tighten conditional access, and monitor privileged roles across the Microsoft ecosystem.

via CyberSecurityNews|

#cloud-security #cve-2026-69836 #cyber-security

security1 month ago•3 min saved

SharePoint deserialization flaw used to steal machine keys and sustain access after patching

Security researchers warn that the critical SharePoint deserialization flaw CVE-2026-50522 is being exploited to steal machine keys, enabling attackers to forge tokens and linger on-premises deployments even after patches; PoC exploits circulated online, prompting defenders to apply July updates and rotate credentials to limit exposure.

via BleepingComputer|

#credential-rotation #cve-2026-50522 #deserialization

security1 month ago•2 min saved

Public PoC Sparks Active Exploitation of Critical SharePoint RCE CVE-2026-50522

Microsoft patched CVE-2026-50522, a critical deserialization-based RCE in SharePoint Server, but a public PoC and threat intel indicate active exploitation of on‑prem deployments. The flaw allows remote code execution over the network, potentially by an attacker authenticated as a Site Owner, enabling arbitrary code execution and theft of IIS machine keys for persistence. Defenders should rotate credentials and deploy patches; CISA warns that multiple SharePoint vulnerabilities are being exploited across supported on‑premises versions.

via The Hacker News|

#active-exploitation #cve-2026-50522 #deserialization