August's SharePoint and vCenter Attacks Show the Patch Window Is Now Measured in Hours
September 8, 2026
Two of the most severe vulnerabilities disclosed this year both got weaponized in the same stretch of August 2026 — and neither gave defenders much more than a day once technical details or a patch were public. If your organization is still treating patching as something that happens during a monthly maintenance window, these two incidents are worth a close look.
SharePoint: from proof of concept to real attacks in under 24 hours
On July 14, 2026, Microsoft and Rapid7 jointly disclosed CVE-2026-55040, a critical authentication bypass in on-premises SharePoint Server (CVSS 9.1) discovered by Rapid7 researcher Stephen Fewer at Pwn2Own Berlin. The flaw let an unauthenticated attacker forge a JSON Web Token — abusing an "alg: none" header and a certificate thumbprint exposed through an unauthenticated metadata endpoint — and impersonate any SharePoint user, including an administrator, with no credentials at all. SharePoint Online was not affected; this hit self-hosted farms.
Both companies agreed to a 30-day disclosure embargo. When Rapid7 published its full technical writeup and a working proof-of-concept on August 11, attackers did not wait long: researchers documented real-world exploitation against internet-facing SharePoint servers within about a day of the PoC going live. Making matters worse, Rapid7 had separately chained the bug with a second flaw, CVE-2026-63520, to achieve fully unauthenticated remote code execution — full server takeover, not just impersonation. Microsoft patched that second bug in its August Patch Tuesday release. Even with both patches available, Shadowserver still counted more than 8,500 SharePoint servers reachable from the open internet weeks after disclosure (an exposure count, not a confirmed unpatched tally).
VMware vCenter: 361 victim IPs in 47 countries in under two weeks
The same month, Broadcom disclosed CVE-2026-59310, a critical path traversal flaw (CVSS 9.8) in the vCenter Server Syslog service, patched July 29, 2026. No authentication or user interaction was required — just network access — to abuse that service and write into privileged locations, effectively handing an attacker root-level control of the appliance that manages an entire virtualized infrastructure. Broadcom confirmed there was no workaround — patching was the only fix.
Exploitation began just five days after the patch shipped. Incident responders at QUIRSO tracking the campaign counted 151 new victim IPs in a single day, with the total reaching 361 unique victim IP addresses across 47 countries within about two weeks, concentrated heavily in Germany, the U.S., Turkey, Iran, and France. Attackers used the access to plant a malicious cron job and establish persistence via reverse_ssh, a tool for maintaining outbound connections to attacker infrastructure.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog within the same August 18 batch that also included a critical Windows IKE remote code execution flaw and a macOS Screen Sharing authentication bypass being used to install cryptominers — a reminder that KEV additions rarely arrive one at a time anymore.
What this means for a mid-sized business
Neither story required novel tradecraft once details were public. They required organizations to leave internet-reachable SharePoint or vCenter a few weeks behind on patches — which still describes a lot of businesses running a monthly maintenance window. A few practical takeaways:
- Know exactly which of your systems — SharePoint, vCenter, firewalls, VPN gateways — are reachable from the public internet. Attackers scan for exposure faster than most IT teams inventory it.
- Treat CISA KEV catalog additions as a same-week action item, not a line item for the next change window. The gap between "patch available" and "mass exploitation" has repeatedly shrunk to days or hours in 2026.
- Management interfaces like vCenter should never be directly internet-facing; put them behind a VPN or jump host with strict access controls, regardless of patch status.
- If you can't patch immediately, know your vendor's mitigation guidance — and if none exists, as with vCenter, be prepared to isolate the system rather than leave it exposed.
For businesses without a dedicated security team watching KEV updates and vendor advisories daily, this is exactly the gap a managed IT partner is supposed to close — not by reacting to headlines, but by already knowing which of your systems were affected before the headline ran.