- Tweets 101
- Following 131
- Followers 2,401
- Likes 495
SharePoint + Pre-Auth RCE + MemShell? 👀
We’ve published our technical analysis of CVE-2026-65660, covering the attack chain from an Allow Anonymous site and a pre-auth SharePoint vulnerability to RCE and MemShell.
Take a look:
blog.viettelcybersecurity.co…
10
142
615
33,856
SharePoint + Pre-Auth RCE + MemShell? 👀
We’ve published our technical analysis of CVE-2026-65660, covering the attack chain from an Allow Anonymous site and a pre-auth SharePoint vulnerability to RCE and MemShell.
Take a look:
blog.viettelcybersecurity.co…
10
142
615
33,856
The CVE record is updated from spoofing to RCE. Waiting for additional bounty. Thanks @msftsecresponse for approving the additional bounty after the RCE reclassification. It hasn't landed yet, just flagging here in case it helps someone tracking the same thing.
1
1
13
1,298
Khoa Dinh retweeted
‼️ ALERT - Microsoft initially classified CVE-2026-65660 as a SharePoint spoofing flaw. It actually enables authenticated RCE.
No in-the-wild exploitation has been reported "yet," but the full exploit markup is now public.
Here's how it works → thehackernews.com/2026/09/sh…
7
40
147
49,972
- CVE-2026-65665, which I reported, was acknowledged by Microsoft. Thanks to @msftsecresponse for the verification.
- Unauthenticated RCE on SharePoint 2019; post-auth RCE on SharePoint SE.
- msrc.microsoft.com/update-gu…
#bugbounty #microsoft #sharepoint
1
6
88
4,423
For allow anonymous sites, this is preauth RCE.
msrc.microsoft.com/update-gu…
1
2
46
4,117
Blog for CVE-2026-55040, SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login:
blog.viettelcybersecurity.co…
!POC is in blog! no need to find SID
1
33
159
12,585
Microsoft released fix for CVE-2026-33112. Site Member permissions could execute code remotely on the SharePoint Server. I'm writing a blog for it.
msrc.microsoft.com/update-gu…
2
30
2,189
blog for CVE-2026-33112, you can use it for SafeControls bypass too, but it will require outbound
blog.viettelcybersecurity.co…
7
14
4,232
Khoa Dinh retweeted
Mind blown alert 🤯! Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning a sweeeeeet $200,000 and 20 Master of Pwn points. Full win let's go! #Pwn2Own #P2OBerlin
4
57
535
51,934
Khoa Dinh retweeted
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
25
174
1,537
285,924
Khoa Dinh retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
109
362
2,571
224,182
I also choose the option: "If this vulnerability is really good, it will come back to me"
Today, we’re releasing watchTowr Labs’ @chudyPB’s BlackHat .NET research, owning Barracuda, Ivanti and more solutions.
Enjoy the read as Piotr explains a new .NET Framework primitive, used to achieve pre- and post-auth RCE on numerous enterprise appliances.
labs.watchtowr.com/soapwn-pw…
8
2,087
Exploit for ToolShell.
Modified ysoserial for crafting DataTable payload.
github.com/l0ggg/ToolShell
3
25
78
9,309
Lâu không để ý có người em đã vào top 3 bug bounty meta
🚀P1 on Meta to kick off 2025!
This achievement puts me in the Top 3 on the Meta Bug Bounty leaderboard! 🔥
Thanks @metabugbounty
#MetaBugBounty #P1
1
7
1,909