Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Public PoC Released for SharePoint Remote Code Execution Vulnerability
Excerpt
A working proof-of-concept exploit for CVE-2026-33112 , a critical vulnerability in Microsoft SharePoint that allows low-privilege authenticated users to achieve remote code execution by bypassing the XmlValidator security control. The flaw represents a fresh bypass of Microsoft’s second patch for CVE-2025-53770 , highlighting the persistent difficulty of fully remediating deserialization-based attack chains in SharePoint’s DataSet handling. PoC for SharePoint RCE…
Read the original report →Attack Flow5 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-33112 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-53770 | High | Score 79/100 | First seen |
IOC Relationship Graph
Building graph …