Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability

CISA added a critical Microsoft SharePoint vulnerability (CVE-2023-29357, CVSS 9.8) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; the flaw allows privilege escalation via spoofed JWT tokens and was demonstrated in an exploit chain combined with CVE-2023-24955. Microsoft issued patches in May/June 2023 and organizations — especially federal agencies — were advised to apply updates by January 31, 2024 to mitigate the threat.