Three Critical Unauthenticated Flaws: SharePoint, Zoom, and WireGuard Easy

Three Critical Unauthenticated Flaws: SharePoint, Zoom, and WireGuard Easy

•

Episode description

Three Critical Unauthenticated Flaws: SharePoint, Zoom, and WireGuard Easy

On 16 July 2026, CISA confirmed active exploitation of CVE-2026-58644, a critical deserialization vulnerability in Microsoft SharePoint that requires no authentication. The same day brought two additional severe vulnerabilities: CVE-2026-53412 in Zoom Workplace for Windows (CVSS 9.8) enabling account takeover, and CVE-2026-63089 in WireGuard Easy (CVSS 9.3) exposing VPN credentials through a trivially exploitable token generation flaw. All three vulnerabilities share a dangerous pattern: they require no credentials, are accessible over a network, and affect tools widely deployed across UK small businesses. This episode provides technical context for each vulnerability, explains the exploitation mechanisms, and delivers explicit remediation steps. Corrine walks through exactly what business owners and IT managers must do before close of business today, including patch application, credential revocation, and documentation practices that matter when facing ICO inquiries or client security questionnaires. This is not theoretical risk assessment; this is active threat response.

Chapters

  • Introduction Corrine introduces three critical vulnerabilities disclosed within 24 hours, all affecting commonly used business tools and requiring no authentication to exploit. One is confirmed as actively exploited in the wild.
  • SharePoint Actively Exploited: CVE-2026-58644 CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalogue on 16 July 2026. This deserialization flaw in Microsoft SharePoint allows unauthenticated remote code execution. The vulnerability affects SharePoint Online and on-premises installations, with immediate patching required.
  • Call to Action Corrine encourages listeners to follow the podcast, leave reviews, and share the episode with business owners and IT managers who need this intelligence.
  • Zoom Account Takeover: CVE-2026-53412 CVE-2026-53412 (CVSS 9.8) affects Zoom Workplace for Windows and the VDI client. An input validation failure allows unauthenticated attackers with network access to take over user accounts, exposing meeting recordings, chat histories, and contact data.
  • WireGuard Easy Credential Theft: CVE-2026-63089 CVE-2026-63089 (CVSS 9.3) affects WireGuard Easy through version 15.3.0. A fundamentally broken token generation mechanism using CRC32 over a 1,000-value keyspace allows trivial credential theft. Patching requires updating to commit 66b292b and revoking all previously issued credentials.
  • The Pattern Worth Noting All three vulnerabilities share critical characteristics: unauthenticated access, network accessibility, and presence in widely deployed business tools. The pattern reflects attacker targeting strategy focused on volume and accessibility.
  • What to Do Before End of Day Concrete remediation steps: patch SharePoint immediately, update Zoom on all Windows devices, update and credential-revoke for WireGuard Easy, confirm patching with IT providers in writing, and document all actions for compliance and client security questionnaires.
  • Closing Corrine summarises the day’s vulnerabilities and remediation requirements. Patches exist for all three flaws; the only variable is whether organisations apply them promptly.

Links