The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified the active exploitation of critical vulnerabilities in Microsoft SharePoint Server, prompting urgent security updates. The first flaw, tracked as CVE-2023-24955, is a code injection vulnerability, allowing authenticated attackers with Site Owner privileges to conduct remote code execution (RCE). The second vulnerability, tracked as CVE-2023-29357, is a privilege escalation flaw enabling attackers to gain administrative rights via spoofed JWT auth tokens. Demonstrated at the Pwn2Own hacking contest in Vancouver by STAR Labs researcher Nguyễn Tiến Giang, these vulnerabilities can be chained for remote code execution on unpatched servers, significantly elevating security risks. In response, CISA has added the flaws to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies apply patches by no later than April 16, 2023, to prevent potential exploits, including those that might not yet have been used in ransomware attacks but pose significant risks to both federal enterprise and private organizations. The move highlights the urgency of addressing these vulnerabilities to protect critical infrastructure and data from malicious cyber actors. CTIX analysts recommend that all administrators ensure their SharePoint instances are up to date with the most recent software update.