SharePoint RCE exploited in the wild, plus a 9.9 in Entra Provisioning

Keycloak doesn't properly validate encrypted SAML assertions, so an attacker who can send crafted SAML responses could bypass authentication and gain unauthorized access. This isn't exploited in the wild yet, but any environment using Keycloak for SAML-based SSO is at risk. CVSS 7.7.

Affected estate

Teams running Keycloak with SAML identity federation enabled

How to check

Check your Keycloak version on the admin console's server info page, or inspect the keycloak-services JAR version in your deployment. Review realm settings for any SAML identity providers or clients with encrypted assertions.

Included because

auth bypass; network-accessible; common identity platform

Action

Upgrade Keycloak to the fixed release and restart the service.

Why it matters

An attacker who can interact with your SAML login flow could bypass authentication entirely.

Source

Keycloak Security Advisory

Algernon, a Go-based web server, leaks server-side script source code on Windows when an attacker uses NTFS alternate data stream filenames in a request. This means your application logic, credentials, or API keys embedded in scripts could be read by anyone who can reach the server. CVSS 8.7.

Affected estate

Anyone running Algernon (xyproto/algernon) as a web server on Windows

How to check

Run algernon --version or check your go.mod for the github.com/xyproto/algernon dependency version.

Included because

information disclosure; internet-facing; no auth required; Windows-specific NTFS trick

Action

Update the Algernon module to the fixed version and redeploy.

Why it matters

Attackers can read your server-side script source, potentially exposing secrets, logic, and credentials.

Source

GitHub Advisory

OpenClaw's Matrix integration binds allowFrom rules to mutable display names instead of stable identifiers. An attacker who can change their display name could bypass access controls and perform actions they shouldn't be authorized for. CVSS 8.8.

Affected estate

Developers and operators using the openclaw npm package with Matrix integration

How to check

Run npm list openclaw in your project directory to confirm the installed version. Review your configuration for any allowFrom rules referencing Matrix display names.

Included because

access control bypass; mutable identifier; auth boundary issue

Action

Upgrade openclaw to the fixed version and switch allowFrom rules to use stable Matrix user IDs instead of display names.

Why it matters

Any Matrix user who can change their display name could impersonate an authorized identity and bypass your access controls.

Source

npm Advisory

A server-side request forgery (SSRF) bug in Microsoft Entra Provisioning Service (SyncFabric) lets an authenticated attacker make the service send requests on their behalf, escalating privileges over the network. CVSS 9.9, which is about as high as it gets. No reports of wild exploitation yet, but the severity score demands fast action.

Affected estate

Anyone using Microsoft Entra Provisioning Service (SyncFabric) for identity provisioning

How to check

Check the Microsoft Entra admin center for provisioning agent versions and review the MSRC advisory for affected version details.

Included because

CVSS 9.9; privilege escalation; network-accessible; SSRF in identity infrastructure

Action

Apply the update from Microsoft or verify your cloud tenant has received the fix. If you run on-prem provisioning agents, update those agents to the patched version.

Why it matters

CVSS 9.9 SSRF with privilege escalation means an attacker with basic auth could pivot through your provisioning infrastructure to reach internal resources.

Source

Microsoft Security Response Center