Leak of Vendor Information Possibly Aided Attackers in Exploiting Microsoft SharePoint Vulnerabilities

A recent report sheds light on a potential leak that may have helped attackers exploit vulnerabilities in Microsoft SharePoint servers, bypassing patches released just days after the attack. The vulnerabilities were exploited by a range of threat actors, including Chinese government hackers, data thieves, and ransomware operators. Dustin Childs, head of Trend Micro’s Zero Day Initiative, suggested the attack might have been aided by early access to vulnerability information given to cybersecurity vendors under a non-disclosure agreement (NDA). Although the attackers could have used sophisticated AI tools like Google’s Gemini to reproduce the exploit chain, Childs speculated that a leak might have been involved. Microsoft’s July Patch Tuesday update, which aimed to fix the vulnerabilities, was reportedly ineffective in fully addressing the issues. Security experts have noted that this could be part of a larger pattern of insufficient fixes or a result of rushed patching. Moreover, there are growing concerns about the security of Microsoft’s Active Protections Program (MAPP), which provides early access to certain vulnerability details for security vendors. Some argue that the lack of timely guidance from Microsoft on critical vulnerabilities could have contributed to the exploit’s success. The incident highlights ongoing concerns about cybersecurity vulnerabilities and patch effectiveness.