{"id":1719,"date":"2026-07-04T07:15:51","date_gmt":"2026-07-04T00:15:51","guid":{"rendered":"https:\/\/vncybers.vn\/cisa-canh-bao-lo-hong-microsoft-sharepoint-server-dang-bi-khai-thac-thuc-te\/"},"modified":"2026-07-04T07:15:51","modified_gmt":"2026-07-04T00:15:51","slug":"cisa-canh-bao-lo-hong-microsoft-sharepoint-server-dang-bi-khai-thac-thuc-te","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/cisa-canh-bao-lo-hong-microsoft-sharepoint-server-dang-bi-khai-thac-thuc-te\/","title":{"rendered":"# CISA c\u1ea3nh b\u00e1o l\u1ed7 h\u1ed5ng Microsoft SharePoint Server \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf"},"content":{"rendered":"<p>C\u01a1 quan An ninh C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng v\u00e0 An ninh m\u1ea1ng Hoa K\u1ef3 (CISA) v\u1eeba b\u1ed5 sung m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Microsoft SharePoint Server v\u00e0o danh m\u1ee5c C\u00e1c l\u1ed7 h\u1ed5ng b\u1ecb khai th\u00e1c \u0111\u00e3 bi\u1ebft (KEV). \u0110\u00e2y l\u00e0 l\u1eddi c\u1ea3nh b\u00e1o \u0111anh th\u00e9p \u0111\u1ed1i v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c v\u1eabn ch\u01b0a th\u1ef1c hi\u1ec7n c\u1eadp nh\u1eadt b\u1ea3n v\u00e1 t\u1eeb th\u00e1ng 5\/2026.<\/p>\n<p>L\u1ed7 h\u1ed5ng n\u00e0y kh\u00f4ng ch\u1ec9 \u0111\u01a1n thu\u1ea7n l\u00e0 m\u1ed9t l\u1ed7i k\u1ef9 thu\u1eadt, m\u00e0 n\u00f3 \u0111ang tr\u1edf th\u00e0nh &#8220;c\u00e1nh c\u1eeda m\u1edf&#8221; cho c\u00e1c nh\u00f3m t\u1ed9i ph\u1ea1m m\u1ea1ng th\u1ef1c thi m\u00e3 t\u1eeb xa, x\u00e2m nh\u1eadp s\u00e2u v\u00e0o h\u1ec7 th\u1ed1ng qu\u1ea3n tr\u1ecb n\u1ed9i b\u1ed9 c\u1ee7a c\u00e1c doanh nghi\u1ec7p.<\/p>\n<h2>Chi ti\u1ebft v\u1ec1 l\u1ed7 h\u1ed5ng CVE-2026-45659<\/h2>\n<p style=\"text-align: center;\"><img decoding=\"async\" src=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/07\/sharepoint-inline.jpg\" alt=\"Microsoft SharePoint Security Analysis\" style=\"max-width: 100%; height: auto;\" \/><\/p>\n<p>L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi m\u00e3 \u0111\u1ecbnh danh <strong>CVE-2026-45659<\/strong> (\u0111i\u1ec3m CVSS: 8.8), thu\u1ed9c lo\u1ea1i l\u1ed7i gi\u1ea3i tu\u1ea7n t\u1ef1 h\u00f3a d\u1eef li\u1ec7u kh\u00f4ng \u0111\u00e1ng tin c\u1eady (deserialization of untrusted data). Theo Microsoft, v\u1ea5n \u0111\u1ec1 n\u00e0y \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn nhi\u1ec1u phi\u00ean b\u1ea3n ph\u1ed5 bi\u1ebfn bao g\u1ed3m:<\/p>\n<ul>\n<li>SharePoint Server Subscription Edition<\/li>\n<li>SharePoint Server 2019<\/li>\n<li>SharePoint Enterprise Server 2016<\/li>\n<\/ul>\n<p>\u0110i\u1ec1u \u0111\u00e1ng lo ng\u1ea1i nh\u1ea5t l\u00e0 k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n c\u00f3 quy\u1ec1n truy c\u1eadp c\u01a1 b\u1ea3n (Site Member) \u0111\u1ec3 k\u00edch ho\u1ea1t l\u1ed7 h\u1ed5ng. Sau khi x\u00e1c th\u1ef1c th\u00e0nh c\u00f4ng, ch\u00fang c\u00f3 th\u1ec3 th\u1ef1c thi m\u00e3 t\u1eeb xa (RCE) tr\u00ean m\u00e1y ch\u1ee7 SharePoint m\u00e0 kh\u00f4ng c\u1ea7n quy\u1ec1n qu\u1ea3n tr\u1ecb vi\u00ean cao c\u1ea5p. \u0110i\u1ec1u n\u00e0y cho th\u1ea5y r\u1ee7i ro c\u1ef1c l\u1edbn n\u1ebfu m\u1ed9t t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng b\u00ecnh th\u01b0\u1eddng b\u1ecb chi\u1ebfm \u0111o\u1ea1t th\u00f4ng qua phishing ho\u1eb7c r\u00f2 r\u1ec9 th\u00f4ng tin.<\/p>\n<h2>S\u1ef1 co c\u1ee5m c\u1ee7a c\u00e1c nh\u00f3m \u0111e d\u1ecda song song<\/h2>\n<p>C\u00f9ng th\u1eddi \u0111i\u1ec3m b\u1ed5 sung v\u00e0o KEV, Microsoft \u0111\u00e3 ti\u1ebft l\u1ed9 m\u1ed9t cu\u1ed9c \u0111i\u1ec1u tra v\u1ec1 m\u00e3 \u0111\u1ed9c t\u1ed1ng ti\u1ec1n (ransomware) cho th\u1ea5y m\u1ed9t hi\u1ec7n t\u01b0\u1ee3ng \u0111\u00e1ng b\u00e1o \u0111\u1ed9ng: nhi\u1ec1u nh\u00f3m tin t\u1eb7c kh\u00e1c nhau c\u00f9ng ho\u1ea1t \u0111\u1ed9ng trong m\u1ed9t m\u1ea1ng l\u01b0\u1edbi b\u1ecb x\u00e2m nh\u1eadp.<\/p>\n<p>Nh\u00f3m Storm-2603, n\u1ed5i ti\u1ebfng v\u1edbi vi\u1ec7c tri\u1ec3n khai m\u00e3 \u0111\u1ed9c Warlock, \u0111\u00e3 li\u00ean t\u1ee5c khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng tr\u00ean m\u00e1y ch\u1ee7 SharePoint t\u1ea1i ch\u1ed7 (on-premises) t\u1eeb gi\u1eefa n\u0103m 2025. Trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p, c\u00e1c chuy\u00ean gia ph\u00e1t hi\u1ec7n Storm-2603 \u0111\u00e3 thi\u1ebft l\u1eadp c\u00e1c k\u00eanh truy c\u1eadp li\u00ean t\u1ee5c th\u00f4ng qua Cloudflare tunneling v\u00e0 Zoho Assist \u0111\u1ec3 duy tr\u00ec s\u1ef1 hi\u1ec7n di\u1ec7n l\u00e2u d\u00e0i trong h\u1ec7 th\u1ed1ng.<\/p>\n<p>Tuy nhi\u00ean, cu\u1ed9c \u0111i\u1ec1u tra c\u0169ng ph\u00e1t hi\u1ec7n d\u1ea5u v\u1ebft c\u1ee7a m\u1ed9t nh\u00f3m \u0111e d\u1ecda th\u1ee9 hai, kh\u00f4ng li\u00ean quan \u0111\u1ebfn Storm-2603, \u0111ang c\u00f9ng t\u1ed3n t\u1ea1i trong c\u00f9ng m\u1ed9t m\u00f4i tr\u01b0\u1eddng. Nh\u00f3m n\u00e0y s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt DLL side-loading v\u00e0 c\u00e1c backdoor t\u00f9y ch\u1ec9nh \u0111\u1ec3 che gi\u1ea5u h\u00e0nh vi, khi\u1ebfn vi\u1ec7c truy v\u1ebft v\u00e0 ng\u0103n ch\u1eb7n tr\u1edf n\u00ean v\u00f4 c\u00f9ng ph\u1ee9c t\u1ea1p.<\/p>\n<h2>B\u00e0i h\u1ecdc v\u1ec1 qu\u1ea3n tr\u1ecb v\u00e0 b\u1ea3o m\u1eadt \u0111a l\u1edbp<\/h2>\n<p>Vi\u1ec7c CISA y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan li\u00ean bang ph\u1ea3i ho\u00e0n t\u1ea5t b\u1ea3n v\u00e1 tr\u01b0\u1edbc ng\u00e0y 4\/7\/2026 cho th\u1ea5y m\u1ee9c \u0111\u1ed9 kh\u1ea9n c\u1ea5p c\u1ee7a v\u1ea5n \u0111\u1ec1. \u0110\u1ed1i v\u1edbi c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng, s\u1ef1 ki\u1ec7n n\u00e0y mang l\u1ea1i nhi\u1ec1u b\u00e0i h\u1ecdc quan tr\u1ecdng:<\/p>\n<p><strong>\u0110\u1eebng ch\u1ee7 quan v\u1edbi c\u00e1c b\u1ea3n v\u00e1 c\u0169:<\/strong> L\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c Microsoft v\u00e1 t\u1eeb th\u00e1ng 5\/2026, nh\u01b0ng vi\u1ec7c b\u1ecb khai th\u00e1c v\u00e0o th\u00e1ng 7 cho th\u1ea5y s\u1ef1 ch\u1eadm tr\u1ec5 trong c\u1eadp nh\u1eadt l\u00e0 t\u1eed huy\u1ec7t c\u1ee7a doanh nghi\u1ec7p.<\/p>\n<p><strong>C\u1ea3nh gi\u00e1c v\u1edbi s\u1ef1 t\u1ed3n t\u1ea1i song song c\u1ee7a tin t\u1eb7c:<\/strong> M\u1ed9t v\u1ee5 t\u1ea5n c\u00f4ng ransomware \u0111\u00f4i khi ch\u1ec9 l\u00e0 ph\u1ea7n n\u1ed5i c\u1ee7a t\u1ea3ng b\u0103ng ch\u00ecm. Trong khi doanh nghi\u1ec7p t\u1eadp trung x\u1eed l\u00fd ransomware, m\u1ed9t nh\u00f3m tin t\u1eb7c kh\u00e1c c\u00f3 th\u1ec3 \u0111ang l\u1eb7ng l\u1ebd \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u th\u00f4ng qua c\u00e1c backdoor tinh vi h\u01a1n.<\/p>\n<p><strong>B\u1ea3o m\u1eadt t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng:<\/strong> V\u00ec <strong>CVE-2026-45659<\/strong> c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c b\u1edfi ng\u01b0\u1eddi d\u00f9ng c\u00f3 quy\u1ec1n th\u1ea5p, vi\u1ec7c tri\u1ec3n khai x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA) v\u00e0 gi\u00e1m s\u00e1t h\u00e0nh vi ng\u01b0\u1eddi d\u00f9ng l\u00e0 l\u1edbp ph\u00f2ng th\u1ee7 kh\u00f4ng th\u1ec3 thi\u1ebfu \u0111\u1ec3 b\u1ea3o v\u1ec7 <strong>VNCyberS<\/strong> v\u00e0 c\u00e1c h\u1ec7 th\u1ed1ng t\u01b0\u01a1ng t\u1ef1.<\/p>\n<p style=\"text-align: right; margin-top: 40px;\"><em><strong>VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News v\u00e0 Microsoft Security Blog<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>C\u01a1 quan An ninh C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng v\u00e0 An ninh m\u1ea1ng Hoa K\u1ef3 (CISA) v\u1eeba b\u1ed5 sung m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Microsoft SharePoint Server v\u00e0o danh m\u1ee5c C\u00e1c l\u1ed7 h\u1ed5ng b\u1ecb khai th\u00e1c \u0111\u00e3 bi\u1ebft (KEV). \u0110\u00e2y l\u00e0 l\u1eddi c\u1ea3nh b\u00e1o \u0111anh th\u00e9p \u0111\u1ed1i v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c v\u1eabn ch\u01b0a [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1718,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1719","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1719"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1719\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1718"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}