Multiple remote code execution vulnerabilities are under active exploitation across Microsoft, AI development platforms, and enterprise software. CISA has escalated a SharePoint RCE to its known exploited vulnerabilities list, while attackers are weaponizing flaws in Langflow and Kemp LoadMaster for ransomware and cryptomining campaigns.
·Microsoft SharePoint RCE (CVE-2026-45659) added to CISA KEV list despite earlier predictions of low exploitation likelihood
·AI development tools like Cursor IDE and Langflow exposed to prompt injection attacks that enable remote code execution
·Attackers deploying Monero miners and ransomware through compromised Langflow endpoints
·Windows Netlogon RCE (CVE-2026-41089) actively exploited with domain controllers targeted
·Progress Kemp LoadMaster pre-authentication RCE flaw facing active exploitation attempts
drawn from The Hacker News, BleepingComputer, csoonline.com, The Register · updated 6h ago