Two Critical Flaws Under Active Attack: VMware vCenter and SharePoint Race the Patch Clock
Two flaws tied to recent patch cycles are under active attack at once. VMware vCenter CVE-2026-59310 fell five days after Broadcom's disclosure, and SharePoint CVE-2026-55040 after a public proof-of-concept. Neither is in CISA's KEV catalog yet — patch internet-facing systems first.
Two critical vulnerabilities tied to recent patch cycles are under active exploitation at the same time, and both crossed from disclosure to real-world attack faster than most organizations can close a patch window. A directory traversal flaw in VMware vCenter, CVE-2026-59310, was exploited just 5 days after disclosure. In parallel, an authentication bypass in Microsoft SharePoint, CVE-2026-55040, came under attack only after a public proof-of-concept surfaced this week.
The timing is the story. CVE-2026-59310 (CVSS 9.8) went from Broadcom's advisory to observed compromise in five days, and CVE-2026-55040 (CVSS 9.1) was attacked within roughly a day of a working PoC going public — turning a CISA warning into fact almost immediately. Neither flaw sits in CISA's Known Exploited Vulnerabilities catalog as of this writing, but the practical order is the same either way: confirm that internet-facing vCenter and SharePoint instances are patched, then audit them for signs of intrusion.
VMware vCenter: Five Days From Advisory to Compromise
CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog service that an unauthenticated attacker with network access can turn into arbitrary code execution. Broadcom, which owns VMware, disclosed it in advisory VMSA-2026-0006 and shipped fixes for the affected 8.0, 9.0 and 9.1 release lines; the vendor lists no workaround, which makes patching the only supported remediation.
Why this rates urgent attention beyond its score is what vCenter is. vCenter Server is the management plane for a VMware estate — the console that administers clusters of ESXi hypervisors and the virtual machines running on them. Code execution on that host is not a single-server problem; it is a foothold over the infrastructure everything else runs on, which is why ransomware crews and state-linked groups have repeatedly prioritized VMware management interfaces. A CVSS 9.8 that is unauthenticated, network-reachable, and lands on the hypervisor control plane is close to a worst-case combination.
According to SecurityWeek and Infosecurity Magazine, researchers traced active exploitation to a campaign that first made contact with attacker-controlled infrastructure roughly five days after the flaw went public. The reported tradecraft is defender-relevant: after abusing the path traversal, the intruders installed a scheduled task that launched an open-source reverse-SSH tool to hold persistent access to compromised hosts. One incident-response team put the spread at hundreds of victim IP addresses across dozens of countries and assessed that a suspected advanced persistent threat actor was behind it — an attribution that comes from a single vendor and should be treated as provisional. No specific victim organizations have been named. The persistence method matters for the cleanup: a cron-scheduled reverse-SSH callback is built to survive reboots and blend into ordinary administrative traffic, so a server that was exposed during the five-day window and later patched still needs to be checked, not assumed clean.
SharePoint: A Public PoC, Then Attacks Within a Day
CVE-2026-55040 is an authentication bypass in Microsoft SharePoint's JWT token-validation pipeline, rated CVSS 9.1. A remote, unauthenticated attacker who exploits it is treated as a legitimate SharePoint user — up to and including an administrator — with no real account behind the request. Microsoft patched the flaw in July 2026, and it has carried a public CVE since mid-July.
On-premises SharePoint has been among the most heavily targeted enterprise applications of the past year, and the reason is structural: it is widely deployed, frequently internet-facing, and rich with the documents and identities attackers want. An authentication bypass is the most dangerous class of flaw for a system like that because it defeats the front door outright — no phishing, no stolen password, just a forged token accepted as a real session. That is a low-friction entry point, and it is why a bypass with a published exploit draws opportunistic scanning almost as soon as the code is available.
What changed this week is the availability of a working exploit. Rapid7 published a technical analysis with an accompanying proof-of-concept, and, as The Hacker News reported, attackers began abusing that PoC almost immediately — post-PoC exploitation that CISA had warned was likely, proven correct within about a day. We covered the disclosure that set this up when Rapid7 chained CVE-2026-55040 to a separate RCE flaw, CVE-2026-63520, to reach unauthenticated remote code execution. Whether that paired RCE is now being exploited alongside the bypass is not confirmed; the current reporting centers on CVE-2026-55040 itself. The distinction matters for triage — the bypass alone hands an attacker a trusted identity, and even without the chained RCE, that is enough to read, alter, or exfiltrate content as a privileged user.
The Shrinking Window Between Disclosure and Exploitation
Read together, the two cases describe the same compressed timeline from different starting points. The vCenter flaw was weaponized off the advisory alone, with no public PoC required — five days was enough. The SharePoint flaw held until a proof-of-concept made the work trivial, and then it took about a day. Either way, the gap defenders have historically relied on — the quiet stretch between a fix shipping and a reliable exploit circulating — is measured in days now, not weeks.
None of this is unique to these two products, but the back-to-back timing makes the trend legible. A detailed advisory and public exploit code both shorten the distance to a working attack; the only variable is which arrives first. When the advisory is detailed enough, as Broadcom's was, attackers do not wait for anyone else's proof-of-concept. When it is not, third-party code fills the gap, as Rapid7's analysis did in the SharePoint case. Defenders control neither input, which is why the response has to be procedural: shrink your own patch-to-production time for internet-facing systems until it is faster than the attacker's disclosure-to-exploit time. It is the same pattern we flagged across this month's Patch Tuesday, where a mid-scoring flaw already under attack outranked dozens of higher-severity bugs that were not. There is no confirmation that the same actor is behind both of this week's campaigns; the through-line is the speed, not a shared operator.
What Defenders Should Verify
Both stories resolve to verification work, and both reward speed on anything reachable from the internet. For vCenter, confirm the environment is on a fixed 8.0, 9.0 or 9.1 build per VMSA-2026-0006, then audit for persistence — unexpected scheduled tasks or cron entries, unfamiliar outbound SSH connections, and any indicators tied to the reported reverse-SSH activity. For SharePoint, confirm the July 2026 fix is actually deployed and then review JWT token audit logs back to mid-July for anomalous token activity or administrator-level actions that lack a matching account.
If either system was internet-reachable at any point after its respective disclosure date, treat detection as a co-equal priority with patching — the update stops future exploitation but does nothing about access already established. Pull external-exposure data for both products first, because an unauthenticated flaw matters most where no foothold is required, and rank remediation by that exposure rather than by CVSS alone.
My Read
My read: the noteworthy thing here is not either flaw on its own — both are patched, and neither is exotic. It is the calendar. Two unrelated products, two different trigger conditions, and both produced live exploitation inside a week of the world learning the bug existed. For CVE-2026-55040, CISA said the quiet part out loud and was proven right within a day. The planning assumption that follows is uncomfortable but simple: treat "patched" and "safe" as two separate states, and close the gap between them before someone else does. Rank by exposure, not by CVSS alone, and put internet-facing vCenter and SharePoint at the top of the list this week. Watch CISA's KEV catalog for both CVEs; a listing would add a federal remediation deadline, but neither one needs a KEV entry to justify acting now.
