← Back to Feed
From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA
March 18, 2026 · Trend Micro · Severity: CRITICAL
Not every cloud breach starts with malware or a zero-day. In this incident, attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, then used the OAuth2 Resource Owner Password Credentials (ROPC) flow to authenticate without MFA.
Key Takeaways
- Attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, and used the OAuth2 Resource Owner Password Credentials flow to authenticate without MFA.
- The incident shows that not every cloud breach starts with malware or a zero-day, and that misconfigurations enable credential theft.
- Organizations should disable or secure Spring Boot Actuator endpoints and enforce MFA-resistant authentication flows to prevent similar bypasses.