CISA Urges SharePoint Hardening After New Exploitations

CISA warns of active exploitation against on‑premises Microsoft SharePoint Server vulnerabilities that allow remote code execution and post‑exploitation activities (stealing IIS machine keys, deserialization attacks, persistence and malware deployment). CISA urges organizations to apply Microsoft patches immediately, verify successful installation, enable and verify AMSI integration for SharePoint web apps, and monitor affected servers for signs of compromise. The feed also notes multiple additions to CISA’s Known Exploited Vulnerabilities (KEV) Catalog and several newly disclosed SharePoint‑/