Will the SharePoint RCE chain PoC be publicly released by end of September 2026?

Attackers are targeting a two-vulnerability chain in Microsoft SharePoint enabling arbitrary code execution on unpatched servers, per Bleeping Computer citing threat intelligence firm Defused. This distinct from single-CVE exploitation.

Resolution Criteria

Confirmation from Bleeping Computer, Defused blog, Microsoft advisory, security researcher Twitter/GitHub, or CISA alert of public PoC or working exploit code targeting the two-CVE chain.