{"id":584,"date":"2026-07-15T14:16:58","date_gmt":"2026-07-15T05:16:58","guid":{"rendered":"https:\/\/onepress.co.kr\/index.php\/briefing\/2026-07-15-microsoft-server-zero-day-check-vi\/"},"modified":"2026-07-15T14:16:58","modified_gmt":"2026-07-15T05:16:58","slug":"2026-07-15-microsoft-server-zero-day-check-vi","status":"publish","type":"briefing","link":"https:\/\/onepress.co.kr\/index.php\/briefing\/2026-07-15-microsoft-server-zero-day-check-vi\/","title":{"rendered":"Microsoft x\u00e1c nh\u1eadn SharePoint Server v\u00e0 AD FS \u0111ang b\u1ecb khai th\u00e1c: c\u1ea7n \u01b0u ti\u00ean b\u1ea3n v\u00e1 ngay"},"content":{"rendered":"<figure class=\"wp-block-image size-large\">\n  <img decoding=\"async\" src=\"https:\/\/onepress.co.kr\/wp-content\/uploads\/2026\/07\/microsoft-server-patch-response-scene.png\" alt=\"Hai nh\u00e2n vi\u00ean CNTT ki\u1ec3m tra t\u1ee7 m\u00e1y ch\u1ee7 v\u00e0 m\u00e0n h\u00ecnh qu\u1ea3n tr\u1ecb trong ph\u00f2ng m\u00e1y d\u1ecbch v\u1ee5 c\u00f4ng s\u00e1ng r\u00f5\" \/><figcaption>H\u00ecnh ONEPRESS v\u1ec1 c\u00f4ng ngh\u1ec7 v\u00e0 an to\u00e0n c\u00f4ng c\u1ed9ng, t\u1eadp trung v\u00e0o ki\u1ec3m tra c\u1eadp nh\u1eadt trong m\u00f4i tr\u01b0\u1eddng v\u1eadn h\u00e0nh th\u1ef1c t\u1ebf.<\/figcaption><\/figure>\n<ul>\n<li><strong>Th\u1eddi \u0111i\u1ec3m ki\u1ec3m tra:<\/strong> 2026-07-15 14:16 KST<\/li>\n<li><strong>C\u01a1 s\u1edf x\u00e1c minh:<\/strong> D\u1eef li\u1ec7u c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt Microsoft ng\u00e0y 14\/7 v\u00e0 danh m\u1ee5c KEV c\u1ee7a CISA c\u1eadp nh\u1eadt c\u00f9ng ng\u00e0y<\/li>\n<\/ul>\n<p><strong>Kh\u00f4ng n\u00ean ch\u1edd k\u1ef3 b\u1ea3o tr\u00ec th\u01b0\u1eddng l\u1ec7 ch\u1ec9 v\u00ec m\u1ed9t \u0111i\u1ec3m s\u1ed1 c\u00f3 v\u1ebb trung b\u00ecnh.<\/strong> Microsoft \u0111\u00e1nh d\u1ea5u CVE-2026-56164 trong SharePoint Server v\u00e0 CVE-2026-56155 trong AD FS l\u00e0 \u0111\u00e3 b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf ng\u00e0y 14\/7. CISA th\u00eam c\u1ea3 hai v\u00e0o KEV c\u00f9ng ng\u00e0y.<\/p>\n<p>SharePoint c\u00f3 th\u1ec3 b\u1ecb t\u1ea5n c\u00f4ng qua m\u1ea1ng m\u00e0 kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c, \u0111\u1ed9 ph\u1ee9c t\u1ea1p th\u1ea5p v\u00e0 kh\u00f4ng c\u1ea7n ng\u01b0\u1eddi d\u00f9ng thao t\u00e1c. AD FS c\u1ea7n k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 quy\u1ec1n th\u1ea5p t\u1ea1i m\u00e1y c\u1ee5c b\u1ed9, nh\u01b0ng c\u00f3 th\u1ec3 d\u1eabn t\u1edbi quy\u1ec1n qu\u1ea3n tr\u1ecb.<\/p>\n<p><strong>X\u00e1c nh\u1eadn khai th\u00e1c kh\u00f4ng c\u00f3 ngh\u0129a m\u1ecdi m\u00e1y ch\u1ee7 \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp.<\/strong> N\u00f3 c\u00f3 ngh\u0129a ki\u1ec3m k\u00ea, v\u00e1, gi\u1ea3m ph\u01a1i l\u1ed9 v\u00e0 l\u01b0u b\u1eb1ng ch\u1ee9ng ph\u1ea3i \u0111\u01b0\u1ee3c \u01b0u ti\u00ean c\u00f9ng l\u00fac.<\/p>\n<h2>\u0110i\u1ec1u g\u00ec \u0111ang b\u1ecb khai th\u00e1c<\/h2>\n<ul>\n<li><strong>CVE-2026-56164:<\/strong> thi\u1ebfu x\u00e1c th\u1ef1c cho ch\u1ee9c n\u0103ng quan tr\u1ecdng c\u1ee7a SharePoint. CVSS 5,3 nh\u01b0ng \u0111\u00e3 b\u1ecb khai th\u00e1c; h\u1ea1n CISA cho c\u01a1 quan li\u00ean bang M\u1ef9 l\u00e0 17\/7.<\/li>\n<li><strong>CVE-2026-56155:<\/strong> ki\u1ec3m so\u00e1t truy c\u1eadp AD FS ch\u01b0a \u0111\u1ee7 chi ti\u1ebft. CVSS 7,8; h\u1ea1n li\u00ean bang M\u1ef9 l\u00e0 28\/7.<\/li>\n<li>C\u00e1c h\u1ea1n n\u00e0y kh\u00f4ng ph\u1ea3i th\u1eddi h\u1ea1n ph\u00e1p l\u00fd to\u00e0n c\u1ea7u, nh\u01b0ng l\u00e0 t\u00edn hi\u1ec7u \u01b0u ti\u00ean m\u1ea1nh cho \u0111\u01a1n v\u1ecb v\u1eadn h\u00e0nh.<\/li>\n<\/ul>\n<h2>Tr\u01b0\u1edbc h\u1ebft h\u00e3y ph\u00e2n lo\u1ea1i m\u00f4i tr\u01b0\u1eddng b\u1ecb \u1ea3nh h\u01b0\u1edfng<\/h2>\n<ul>\n<li><strong>SharePoint:<\/strong> Enterprise Server 2016, Server 2019 v\u00e0 Subscription Edition. SharePoint Online kh\u00f4ng \u0111\u01b0\u1ee3c li\u1ec7t k\u00ea l\u00e0 s\u1ea3n ph\u1ea9m b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/li>\n<li><strong>AD FS:<\/strong> danh s\u00e1ch g\u1ed3m Windows Server 2012, 2012 R2, 2016, 2019, 2022 v\u00e0 2025. H\u00e3y x\u00e1c nh\u1eadn vai tr\u00f2 AD FS c\u00f3 th\u1ef1c s\u1ef1 \u0111\u01b0\u1ee3c tri\u1ec3n khai.<\/li>\n<li><strong>Thi\u1ebft b\u1ecb c\u00e1 nh\u00e2n:<\/strong> ng\u01b0\u1eddi ch\u1ec9 d\u00f9ng Microsoft 365 m\u00e0 kh\u00f4ng t\u1ef1 v\u1eadn h\u00e0nh m\u00e1y ch\u1ee7 kh\u00f4ng c\u00e0i b\u1ea3n v\u00e1 m\u00e1y ch\u1ee7 n\u00e0y; h\u00e3y h\u1ecfi qu\u1ea3n tr\u1ecb vi\u00ean c\u01a1 quan.<\/li>\n<\/ul>\n<h2>S\u00e1u b\u01b0\u1edbc c\u1ea7n l\u00e0m h\u00f4m nay<\/h2>\n<ol>\n<li><strong>Ki\u1ec3m k\u00ea v\u00e0 ch\u1ee7 s\u1edf h\u1eefu:<\/strong> ghi m\u1ecdi c\u1ee5m SharePoint v\u00e0 m\u00e1y AD FS t\u1ea1i ch\u1ed7, phi\u00ean b\u1ea3n, \u0111\u1ecba ch\u1ec9 c\u00f4ng khai, m\u1ee9c ph\u01a1i l\u1ed9 v\u00e0 \u0111\u01a1n v\u1ecb ph\u1ee5 tr\u00e1ch.<\/li>\n<li><strong>\u01afu ti\u00ean SharePoint:<\/strong> KB5002891 cho 2016, KB5002883 cho 2019, KB5002882 cho Subscription Edition. Sao l\u01b0u, l\u00e0m theo h\u01b0\u1edbng d\u1eabn ch\u00ednh th\u1ee9c v\u00e0 ki\u1ec3m tra build c\u00f9ng t\u00ecnh tr\u1ea1ng c\u1ee5m.<\/li>\n<li><strong>D\u00f9ng AMSI \u0111\u1ec3 t\u0103ng c\u01b0\u1eddng:<\/strong> b\u1eadt t\u00edch h\u1ee3p SharePoint\/IIS v\u00e0 Request Body Scan \u1edf Full. \u0110\u00e2y kh\u00f4ng ph\u1ea3i thay th\u1ebf b\u1ea3n v\u00e1.<\/li>\n<li><strong>C\u1eadp nh\u1eadt AD FS:<\/strong> \u00e1p d\u1ee5ng b\u1ea3n Windows th\u00e1ng 7 \u0111\u00fang phi\u00ean b\u1ea3n; chu\u1ea9n b\u1ecb kh\u1edfi \u0111\u1ed9ng l\u1ea1i, d\u1ef1 ph\u00f2ng v\u00e0 ho\u00e0n t\u00e1c.<\/li>\n<li><strong>L\u01b0u b\u1eb1ng ch\u1ee9ng:<\/strong> gi\u1eef log IIS, SharePoint, Windows, x\u00e1c th\u1ef1c v\u00e0 qu\u1ea3n tr\u1ecb. \u0110\u0103ng nh\u1eadp, \u0111\u1ed5i quy\u1ec1n ho\u1eb7c qu\u1ea3n tr\u1ecb vi\u00ean b\u1ea5t th\u01b0\u1eddng c\u1ea7n quy tr\u00ecnh \u1ee9ng c\u1ee9u s\u1ef1 c\u1ed1.<\/li>\n<li><strong>Ki\u1ec3m th\u1eed sau v\u00e1:<\/strong> th\u1eed t\u00ecm ki\u1ebfm, t\u1ea3i l\u00ean, \u0111\u0103ng nh\u1eadp SharePoint v\u00e0 c\u1ea5p token AD FS; ghi KB, gi\u1edd, ng\u01b0\u1eddi l\u00e0m v\u00e0 k\u1ebft qu\u1ea3.<\/li>\n<\/ol>\n<h2>Ng\u01b0\u1eddi d\u00f9ng v\u00e0 nh\u00e0 cung c\u1ea5p c\u1ea7n ki\u1ec3m tra g\u00ec<\/h2>\n<ul>\n<li>Nh\u00e2n vi\u00ean v\u00e0 sinh vi\u00ean kh\u00f4ng \u201cv\u00e1\u201d b\u1eb1ng c\u00e1ch b\u1ea5m li\u00ean k\u1ebft trong tin nh\u1eafn; ch\u1ec9 d\u00f9ng c\u1ed5ng v\u00e0 b\u1ed9 ph\u1eadn h\u1ed7 tr\u1ee3 ch\u00ednh th\u1ee9c.<\/li>\n<li>Nh\u00e0 cung c\u1ea5p ph\u1ea3i b\u00e1o danh s\u00e1ch m\u00e1y, KB, th\u1eddi gian, kh\u1edfi \u0111\u1ed9ng l\u1ea1i v\u00e0 k\u1ebft qu\u1ea3 th\u1eed d\u1ecbch v\u1ee5.<\/li>\n<li>N\u1ebfu giao di\u1ec7n qu\u1ea3n tr\u1ecb m\u1edf th\u1eb3ng ra internet, c\u1ea7n xem l\u1ea1i VPN, ki\u1ec3m so\u00e1t truy c\u1eadp v\u00e0 danh s\u00e1ch cho ph\u00e9p ngo\u00e0i vi\u1ec7c v\u00e1.<\/li>\n<\/ul>\n<h2>C\u00e1ch hi\u1ec3u c\u1ea3nh b\u00e1o m\u00e0 kh\u00f4ng ph\u00f3ng \u0111\u1ea1i<\/h2>\n<ul>\n<li>Kh\u00f4ng \u0111\u1ec3 nh\u00e3n Moderate ho\u1eb7c \u0111i\u1ec3m 5,3 l\u00e0m gi\u1ea3m \u01b0u ti\u00ean khi \u0111\u00e3 c\u00f3 khai th\u00e1c th\u1ef1c t\u1ebf.<\/li>\n<li>Khai th\u00e1c to\u00e0n c\u1ea7u kh\u00f4ng ch\u1ee9ng minh m\u1ed9t t\u1ed5 ch\u1ee9c c\u1ee5 th\u1ec3 \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp.<\/li>\n<li>Kh\u00f4ng nh\u1ea7m SharePoint Online v\u1edbi SharePoint Server t\u1ea1i ch\u1ed7.<\/li>\n<li>AMSI kh\u00f4ng thay b\u1ea3n v\u00e1; b\u1ea3n v\u00e1 c\u0169ng kh\u00f4ng lo\u1ea1i tr\u1eeb x\u00e2m nh\u1eadp tr\u01b0\u1edbc \u0111\u00f3.<\/li>\n<\/ul>\n<h2>Ngu\u1ed3n ch\u00ednh th\u1ee9c<\/h2>\n<ul>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2026-56164\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Security Update Guide: CVE-2026-56164 (SharePoint Server)<\/a><\/li>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2026-56155\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Security Update Guide: CVE-2026-56155 (AD FS)<\/a><\/li>\n<li><a href=\"https:\/\/api.msrc.microsoft.com\/cvrf\/v3.0\/cvrf\/2026-Jul\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft July 2026 security update data (official CVRF API)<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener noreferrer\">CISA Known Exploited Vulnerabilities Catalog<\/a><\/li>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sharepoint\/security-for-sharepoint-server\/configure-amsi-integration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Configure AMSI integration with SharePoint Server<\/a><\/li>\n<\/ul>\n<p><strong>K\u1ebft lu\u1eadn:<\/strong> N\u1ebfu v\u1eadn h\u00e0nh SharePoint Server ho\u1eb7c AD FS, h\u00e3y x\u00e1c \u0111\u1ecbnh \u0111\u00fang phi\u00ean b\u1ea3n, \u01b0u ti\u00ean SharePoint v\u00e0 ch\u1ec9 \u0111\u00f3ng vi\u1ec7c sau khi ki\u1ec3m tra AMSI, log v\u00e0 lu\u1ed3ng d\u1ecbch v\u1ee5.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft x\u00e1c nh\u1eadn hai l\u1ed7 h\u1ed5ng SharePoint Server v\u00e0 AD FS \u0111ang b\u1ecb khai th\u00e1c; CISA \u0111\u00e3 th\u00eam c\u1ea3 hai v\u00e0o KEV. T\u1ed5 ch\u1ee9c t\u1ef1 v\u1eadn h\u00e0nh m\u00e1y ch\u1ee7 c\u1ea7n ki\u1ec3m tra t\u00e0i s\u1ea3n, ph\u01a1i l\u1ed9, b\u1ea3n v\u00e1 v\u00e0 log h\u00f4m nay.<\/p>\n","protected":false},"featured_media":0,"template":"","meta":[],"class_list":["post-584","briefing","type-briefing","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing\/584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing"}],"about":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/types\/briefing"}],"wp:attachment":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/media?parent=584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}