Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202607-00000003

【CVE-2026-48558】SimpleHelp Authentication Bypass Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】There is an authentication bypass vulnerability in SimpleHelp's OIDC authentication process. When OIDC authentication is enabled on the system, the login process does not properly verify the cryptographic signature of the identity token. A remote unauthenticated attacker may submit a forged token to obtain an authenticated technician session; under some configurations, the attacker may even bypass multi-factor authentication.

【CVE-2026-45659】Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability (CVSS v3.1: 8.8)
【Whether exploited by ransomware: Unknown】Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability, allowing an authorized attacker to execute arbitrary code over the network.