Cyber

What changed

Rapid7 Labs has uncovered a significant security issue within Microsoft SharePoint, consisting of two vulnerabilities that, when exploited together, enable unauthenticated remote code execution (RCE). The second vulnerability, identified as CVE-2026-63520, has been disclosed alongside the first, CVE-2026-55040, which was revealed last month.

• CVE-2026-63520 allows attackers to execute arbitrary code remotely.
• CVE-2026-55040 serves as a prerequisite for the exploitation of CVE-2026-63520.
• Both vulnerabilities pose a severe risk to the security of SharePoint servers.

Who is affected

Organizations utilizing Microsoft SharePoint are at risk due to these vulnerabilities. The potential impact is significant, affecting various sectors that rely on SharePoint for collaboration and document management.

• Microsoft SharePoint users across multiple industries.
• Organizations with outdated or unpatched SharePoint installations.
• IT departments responsible for maintaining SharePoint environments.

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with these vulnerabilities. Regular updates and patches should be applied to ensure systems are secure.

Monitor for any unusual activity on SharePoint servers and implement additional security measures as needed.

• Review and apply the latest security patches from Microsoft.
• Conduct a security audit of SharePoint installations.
• Educate staff on the risks associated with these vulnerabilities.

What changed

The Balbooa Forms extension for Joomla has been identified with a critical vulnerability that allows for unrestricted file uploads. This flaw enables attackers to upload executable files without authentication, which can lead to complete remote code execution (RCE).

The vulnerability affects versions of Balbooa Forms prior to 2.4.1, making it imperative for users to assess their current installations.

Who is affected

The vulnerability impacts users of the Balbooa Forms extension, particularly those running versions below 2.4.1. This includes a wide range of Joomla users who rely on this extension for form management.

Organizations utilizing Joomla for their web applications should be particularly vigilant, as the flaw could expose sensitive data and systems to unauthorized access.

• Joomla users utilizing Balbooa Forms extension versions < 2.4.1
• Web developers and administrators managing Joomla sites
• Businesses relying on Joomla for customer interaction and data collection

What to do

It is crucial for affected users to immediately update the Balbooa Forms extension to version 2.4.1 or later to mitigate the risk of exploitation. Regularly monitoring for updates and patches is essential in maintaining security.

In addition, organizations should review their security policies regarding file uploads and implement additional measures to restrict file types and validate uploads.

• Update Balbooa Forms to version 2.4.1 or later
• Implement file type restrictions and validation for uploads
• Conduct a security audit of Joomla installations to identify potential vulnerabilities