Jul 02 2026 Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list

Source

Attackers need little more than a valid SharePoint account to execute code on vulnerable on-prem servers [...]