CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution RCE against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft ar...

smb/client: handle overlapping allocated ranges in fallocate

...

PT-2026-70724

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds write issue exists that allows an unauthorized attacker to execute arbitrary code locally or remotely, potentially compromising the affected system...

PT-2026-70572

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description Incorrect authorization allows an authorized attacker to elevate privileges over a network, which enables them to affect the system. Recommendations At the moment, there is no...

PT-2026-70788

Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...

PT-2026-70623

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An integer overflow or wraparound occurs in Microsoft Office, which could allow an unauthorized attacker to execute arbitrary code locally or remotely, potentially affecting the enti...

PT-2026-70627

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment, there is no information...

PT-2026-70748

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A use after free condition exists in Microsoft Office Word, which allows an unauthorized attacker to execute arbitrary code locally or remotely, potentially affecting the entire...

PT-2026-70634

Name of the Vulnerable Software and Affected Versions Microsoft Office Access affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an unauthorized...

PT-2026-70709

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially leading to memory corruption. This issue allows an...

PT-2026-70680

Name of the Vulnerable Software and Affected Versions Windows DHCP Client affected versions not specified Description Uncontrolled resource consumption in the Windows DHCP Client allows an unauthorized attacker to cause a denial of service over an adjacent network. Recommendations At the moment,...

PT-2026-70743

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70389

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

PT-2026-70417

Name of the Vulnerable Software and Affected Versions Microsoft Remote Registry Service affected versions not specified Description A null pointer dereference in the Microsoft Remote Registry Service allows an authorized attacker to cause a denial of service over a network. A null pointer...

PT-2026-70757

Name of the Vulnerable Software and Affected Versions Microsoft Office PowerPoint affected versions not specified Description Improper input validation allows an unauthorized attacker to disclose information locally. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-70645

Name of the Vulnerable Software and Affected Versions Microsoft Office Access affected versions not specified Description A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent...

PT-2026-70620

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to locally disclose sensitive information, which can impact the system. Recommendations At the moment, there is no information...

PT-2026-70604

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Incorrect authorization allows an authorized attacker to perform tampering over a network, which enables them to affect the system. Recommendations At the moment, there is...

PT-2026-70730

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an unauthorized...

Security Update for Microsoft PowerPoint Products (August 2026)

The Microsoft PowerPoint Products are missing a security update. They are, therefore, affected by an information disclosure vulnerability. Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. Note that Nessus has not tested for this...