Topic starter
30/07/2026 10:50 pm
TL;DR: Microsoft SharePoint Server unauthenticated RCE is already being exploited in the wild, while CISA KEV listings also highlight active risk across Exchange, ColdFusion, UniFi, WordPress, and other exposed systems, according to Senserva. The pattern is clear: exploitation evidence, not severity alone, should drive patch order and hunting.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “SharePoint RCE Exploited and a ColdFusion CVSS 10 in KEV”.
By the numbers:
- CVE-2026-48282 is rated CVSS 10 and listed on the CISA KEV catalog.
- Ubiquiti UniFi OS CVE-2026-34910 also carries CVSS 10 with an EPSS score of roughly 0.79.
- The older Alcatel OmniPCX CVE-2007-3010 shows an EPSS near 0.98.
Key questions
Q: What breaks when unauthenticated RCE is present on an internet-facing collaboration server?
A: It removes the need for valid credentials at the entry stage and turns the server itself into the access vector.
Q: Why does KEV status matter more than CVSS for exposed edge systems?
A: KEV status matters because it confirms active exploitation, while CVSS only describes theoretical severity.
Q: What signs show a SharePoint exploit has moved from entry to post-exploitation?
A: The strongest signs are a suspicious ASPX drop such as spinstall0.aspx, followed by w3wp.exe spawning cmd.exe or powershell.exe, and then outbound connections that do not match normal SharePoint behaviour.
Practitioner guidance
- Prioritise active exploitation over raw severity Re-rank remediation queues so KEV-listed and in-the-wild exploited issues move ahead of higher-scoring but unexploited findings.
- Patch exposed SharePoint servers first Confirm on-premises SharePoint nodes are on current builds, then validate that internet-facing instances are not left on legacy code paths.
- Hunt for web shell persistence Search SharePoint web roots, upload paths, and adjacent IIS artefacts for suspicious files or modified timestamps that indicate post-exploit activity.
Bottom line: The article shows that unauthenticated SharePoint RCE is already an active exploitation problem, not a future hardening issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:57 pm
Patch severity is no longer the primary decision variable when exploitation is already observed. The governance mistake is treating CVSS as the main input when the attacker community is already using the flaw. For exposed enterprise platforms, exploitation evidence should outrank abstract score ordering because it better predicts who gets hit next. The practical conclusion is to build patch priority around observed use, not potential use.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations prioritise exploited edge systems over unexploited critical bugs?
A: Yes, when the exploited system is reachable from the internet or can bridge into sensitive internal services. Exploited edge systems deserve first-line remediation because they combine confirmed attacker interest with immediate exposure and a higher chance of follow-on compromise.
👉 Read our full editorial: Sharepoint rce and active exploitation are driving urgent patching