SharePoint Under Active Attack, AI Ransomware, and FortiBleed

CISA has confirmed active exploitation of CVE-2026-45659, a remote code execution vulnerability in Microsoft SharePoint Server. UK small businesses running on-premises SharePoint need to verify patch status immediately, not when convenient. This episode examines the gap between Microsoft’s May patch release and delayed security bulletin, explains why basic site members can exploit this flaw to gain server control, and clarifies the distinction between cloud-hosted and on-premises risk. We also cover JADEPUFFER, the first documented ransomware attack conducted entirely by an AI agent without human operators, and FortiBleed, a credential theft campaign targeting Fortinet devices that fed directly into INC and Lynx ransomware operations. The common thread: automated attack pipelines are eliminating the economic barriers that previously made small businesses lower-priority targets. Corrine provides five specific actions to complete before the end of the week, including how to verify your SharePoint patch status, check AI development tool exposure, confirm Fortinet firmware versions, test offline backups, and request patch reports from your MSP.

Chapters

• Introduction Corrine introduces three active threat stories: CISA-confirmed SharePoint exploitation, AI-automated ransomware, and credential theft feeding ransomware pipelines. None are theoretical.
• SharePoint Under Active Attack: CVE-2026-45659 CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalogue on 1 July 2026, confirming active exploitation of a SharePoint Server remote code execution flaw. The vulnerability allows basic site members to execute arbitrary code through deserialisation of untrusted data. Microsoft patched in May but delayed the security bulletin by weeks, creating a window where IT teams had no visibility. On-premises SharePoint deployments require manual patching; cloud-hosted SharePoint Online is managed by Microsoft. UK businesses must confirm patch status today with their MSP or IT provider.
• Call to Action Corrine asks listeners to follow the show, leave reviews, and share the episode with small business owners and IT providers.
• AI-Automated Ransomware: JADEPUFFER Sysdig documented the first ransomware attack conducted entirely by an AI agent without human operators, tracked as JADEPUFFER. Initial access exploited CVE-2025-3248 in Langflow, an open-source AI development tool. The AI handled credential theft, lateral movement, encryption, and database wiping autonomously. This removes the human operator time bottleneck that previously made small businesses less attractive targets. Offline backups, disconnected from the network, become essential as automated attacks compress detection windows.
• FortiBleed: Credential Theft Feeding Ransomware Pipelines SOCRadar linked the FortiBleed campaign to INC and Lynx ransomware operations. The campaign exploited Fortinet FortiGate devices, resulting in 354 confirmed intrusions and at least 12 ransomware deployments. Stolen credentials moved quickly from compromise to ransomware use. UK businesses using Fortinet equipment must verify current firmware versions with their MSP or IT provider.
• Conclusion and Action Steps Corrine provides five specific actions to complete before Friday: confirm SharePoint patch status for CVE-2026-45659, check AI development tool internet exposure, verify Fortinet firmware versions, test offline backup restoration, and request written patch reports from MSPs. Businesses that ask the right questions of IT providers navigate threats more effectively than those relying solely on budget.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://sysdig.com/blog/jadepuffer-ai-ransomware/
• https://socradar.io/fortibleed-credential-theft-campaign-linked-to-inc-and-lynx-ransomware/