Daily Cyber Threat Intel Brief — 2026-08-12

Generated: 2026-08-12 08:00:14 UTC

Executive summary

Priority technology watch items

- Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint…

- Overview On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept…

- Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

- Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

- CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. [...]

- Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday , including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to…

- Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

- Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

- Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

- Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

- Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

- Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

- Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.

- Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

- Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

- Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

- Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

- Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

- U.S. federal agencies and South Korea's National Policy Agency warned government and critical infrastructure organizations worldwide to secure their systems against Gunra ransomware attacks. [...]

- This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as zero-days. Notable fixes include Windows privilege escalation, container tampering, and critical QUIC and DNS…

Newly exploited vulnerabilities / CVE watch

Ransomware and extortion trend notes

Malware / infrastructure / abuse feed highlights

IOC highlights

Defensive takeaways

Sources checked

Limitations