SharePoint Zero-Auth Bypass, macOS Screen Sharing Flaw, Copilot Data Leak

Three critical vulnerabilities confirmed as actively exploited demand immediate attention from UK small businesses. CVE-2026-55040 allows unauthenticated attackers to bypass SharePoint authentication entirely, no credentials required. CVE-2026-65400 lets attackers on your local network gain full control of unpatched Macs through Screen Sharing without valid credentials. CVE-2026-24301, now patched, demonstrated how a single crafted link could silently exfiltrate data from Microsoft Copilot Personal. Corrine walks through the practical threat model for each vulnerability, why CISA’s Known Exploited Vulnerabilities catalogue additions matter, and the specific actions UK small businesses must take today: patch SharePoint or restrict access immediately, update all Macs to macOS Tahoe 26.6.2, verify Copilot versions and audit connected services. This episode emphasises the gap between Cyber Essentials compliance timelines and the reality of active exploitation, the false security of local network restrictions, and the emerging attack surface created by AI tools with broad data access.

Chapters

• Introduction Three vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalogue overnight, two requiring zero credentials to exploit, including one in the AI assistant staff are likely using.
• CVE-2026-55040: SharePoint Authentication Bypass Microsoft SharePoint authentication bypass allows unauthenticated network attackers complete access. CISA KEV listing confirms active exploitation. Immediate patching or access restriction required for internet-facing SharePoint instances used by UK small businesses through Microsoft 365.
• Call to Action Listener engagement request: follow, rate, review, and share the show to help more UK small businesses respond to threats.
• CVE-2026-65400: Apple macOS Screen Sharing Improper authentication in macOS Screen Sharing allows local network attackers full remote control without credentials. Threat model includes office Wi-Fi, guest networks, VPN connections, and compromised pivot points. Apple released macOS Tahoe 26.6.2 to address the flaw.
• CVE-2026-24301: Copilot Data Exfiltration Microsoft Copilot Personal vulnerability, now patched, allowed silent data exfiltration via crafted links executing attacker-controlled prompts. Demonstrates prompt injection risks in commercial AI tools. Guidance on auditing AI tool data access and limiting blast radius.
• Conclusion Summary of three confirmed active exploits and specific actions required: patch SharePoint immediately, update all Macs to macOS Tahoe 26.6.2 today, verify Copilot versions and audit connections. The cost of patching is time; the cost of not patching is breach notifications and incident response.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog