# CISA: Microsoft SharePoint flaw now exploited in ransomware attacks

> **Open Intelligence Dossier** · First detected: 2026-08-11 17:07 UTC · Category: Business

## Executive Summary
CISA and international security agencies warn of a surge in ransomware attacks targeting Microsoft SharePoint and critical infrastructure.

## Intelligence Brief
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that a flaw within Microsoft SharePoint is currently being exploited in ransomware attacks. Concurrent reports indicate that a group known as the Gunra ransomware gang is specifically targeting critical infrastructure. This group is utilizing various vulnerabilities to breach networks, including flaws associated with Schneider Electric and Fortinet products, to facilitate their ransomware deployments. Coverage of these threats is being driven by a mix of government agencies and cybersecurity news outlets. BleepingComputer reported the specific CISA warning regarding Microsoft SharePoint, while The Hacker News detailed the Gunra ransomware gang's use of Fortinet and Schneider Electric flaws.


The Record from Recorded Future News highlighted the collaborative warnings issued by the FBI and South Korea regarding the targeting of critical infrastructure. Additionally, a LinkedIn alert noted that zero-day vulnerabilities in SonicWall SMA1000 are being exploited to breach enterprise networks. This series of events underscores a coordinated effort by security organizations to defend against sophisticated actors. The National Security Agency (NSA) joined the FBI and other partners in releasing formal guidance designed to help organizations defend against Gunra ransomware. The involvement of both the NSA and FBI, alongside international cooperation from South Korea, indicates the high stakes involved when critical infrastructure is targeted by ransomware gangs.


These attacks often rely on exploiting known or zero-day flaws in enterprise hardware and software to gain initial access. Future developments to monitor include the release of further defense guidance from the NSA and FBI as they continue to track the Gunra ransomware gang. Organizations using Microsoft SharePoint, Fortinet, Schneider Electric, and SonicWall SMA1000 systems are the primary focus of current security warnings. Coverage does not yet specify if patches for all mentioned flaws have been deployed, but the emphasis remains on the active exploitation of these specific vulnerabilities to breach enterprise and critical infrastructure networks.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| The Register | Feds warn Gunra ransomware is exploiting known bugs to hit critical infrastructure | [Source Link](https://news.google.com/rss/articles/CBMi2AFBVV95cUxPMWIzT0x0MXV4SVlJXy1udDVKQnlKaEg2UkFQVExUbDRsWmlMeWVGTU0tMnVCNVp5SE5GRF9ZdjRsU2hSZkpIYzNtR1hPVnJ2SkRVaUxnaUN4ZmM0NTM3bXpCSHBUbWQ5THZsSzcyNXhmSFlPWGNyU1Roamx6OW9rUXhKOWhCQ3FfNkM3LWU4MUZqcmYxQmVIcUJjZE12ZzRyLTNrWjNXVl9MdlRqajU0dVpXbzZic0VHak9jUm1uU0g3bEdzNHV0M3MzUEUwb1Q1WWJ3R1Z6clI?oc=5) |
| Industrial Cyber | Gunra ransomware expands globally as US, South Korean agencies warn of data theft, encryption and extortion tactics | [Source Link](https://news.google.com/rss/articles/CBMi3wFBVV95cUxNeVBwRlMtaU9PZERxZmc0a3dDUTQwX0hJcTJsX2VZUm9MbVJzTm9rYXctMWQtc0k0R1VRMlZqZnFURk5sZnBDM0VNSTMwWE52cno5YmRNbWcyZzB5dDNYYXdjVHFwR2xGY0ZJMmZjSVBOdnV2cFdRRkxpeEktTTZWN1lDV1I1OEhZaEhIMHVyLVlmOGlaM0VNbzlnM2dtNWUtV3gtUk9Da3NMWG1rTWdWd1o2NFhfR3ZyM25yNW5TNFpSU0ZiYUZWNjAxbDJzTzhGSmE3LVZadVJ6NUs1ZFdv?oc=5) |
| National Security Agency (NSA) (.gov) | NSA Joins FBI and Others in Releasing Guidance to Defend Against Gunra Ransomware | [Source Link](https://news.google.com/rss/articles/CBMiggJBVV95cUxNOWlMd21saGxjam11djdyMnZPd0gwOTJYcjN5cnZ5aHhRUG1ncENvMGVyLXlLdVNTaFV1a1BoVUVhMWtlbzVVajFNcFNsdmFweThlUk9MNXl1ekI5M0pwbmV3NWtIc0dnRmk5OXFnUnhnLUE4d2lGaTYwTG9YLVFIc3V1czhidVNCSXlSVUc2ZGZuSnhnVEtnbE5mTWw5QUNuOEZVdGFNakRYMkxYaWpvb0lrRlVpQkhINUdvTlJjWXhvSlhlMGpfRUl2am5qb3otOFgxNEdUZmlTQlFXRjlrWkF3TUY5eWZDdGZyaEVfMmlpYzQ0WlhkNnFiemQ4TlpWOWc?oc=5) |
| LinkedIn | WARNING: SonicWall SMA1000 Zero-Days Exploited To Breach Enterprise Networks | [Source Link](https://news.google.com/rss/articles/CBMikwFBVV95cUxQcmNRSE1rUjFmU29wU2s0TjEzakhabHctWTBPcnRiNFpKb1p4T1ZoNEMxME1vSldiLWU1ODBIQWN5RmtWbDYwbEg5YzhOZUhYN1dXLWdjbVBia29FTkJWdW5zZ1RQZjBNSnF6RFpobkRQcldsa0dKckFvcnlibWNNMFh6UjdfZTNNN2JqRG11UFI4LWc?oc=5) |
| The Record from Recorded Future News | FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure | [Source Link](https://news.google.com/rss/articles/CBMiZ0FVX3lxTE05SExleU9CZlcxQURSckVINDRDUjJmczc0R1hENnlNQldHMzg3U0hLRVdhalY3TkpwR2FsV0Ezalc3VC1uVTFTQVVEVVEtanJEc0w2bHNidW9lcWVFb2gwX3RxMmlfOVU?oc=5) |
| The Hacker News | Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks | [Source Link](https://news.google.com/rss/articles/CBMigwFBVV95cUxPM0RGcjBMRUp1RHhCNG5NQUtmeGNzdWtxa2I1Q2JadnFYNDUtajJkYzl0SU1YeEZfYmlNSkhWcVlJajdId21RaWp5TFFpa0o2WWZrTjdhREJJV0pTMV8wbEc0NkJPNmd0Q2hKRWRtYTdVRGRKV1ZBSUJvM25FMWVqWDQtOA?oc=5) |
| BleepingComputer | CISA: Microsoft SharePoint flaw now exploited in ransomware attacks | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxNWGo1UktKX3JFVlNCTHBfdm5hQ3ZSUnFGX3A5Q1p3SE1oWWwwTlZSUm9HQjc2VEtZclpKSzVxM1FQWEx6ZmgwXzByV1FzRENJREgwRkpNZ0hZVktPTTFIOGt6R0hwal92VXZoMUc2WDViamFRQTRSZkNvNmFlMk9aYjNkRHhrTktvbmFLdmZIbTYwYmJxNy1HdEczcHhrRG9tNm5JTzQ5WWs4SUx6bWlGSVBNZGrSAboBQVVfeXFMT016NmxscFFZa2ZfRVVDVjVhT2lQN2djbEhSalBmRGc2TENyVDAxRmdWTnAzUkhDNkhvTlVNc0x4ZTdBTkpET3FtLWItdlZ6ZzE3TzV0aTJERzBNX3dpS0g5RlZuWjVuSVphMHR6S3VoT2RMUHRJX1A4cjU4TmpmMTFZS05mLTc5NnkwVnpPR0RRejhTOHBMT21LRG5jM2Z) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-08-11/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks*