CISA: Critical Microsoft SharePoint bug now actively exploited

CISA and multiple researchers highlight a critical SharePoint privilege‑escalation flaw (CVE-2023-29357) that can be combined with CVE-2023-24955 to achieve remote code execution; public proof‑of‑concepts and demos (including a Pwn2Own chain) have emerged, and CISA placed CVE-2023-29357 on its Known Exploited Vulnerabilities Catalog, requiring U.S. federal agencies to patch by January 31 — lowering the exploitation bar for unpatched SharePoint servers and raising risk for organizations that do not update.