cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CISA Adds Exploited SharePoint and FortiSandbox Flaws to KEV

· Original article ↗

Summary

CISA added an exploited SharePoint RCE flaw and two FortiSandbox command-injection flaws to its KEV catalog, urging federal agencies to patch all three within three days.

Key points

  • Microsoft says CVE-2026-58644 is a critical SharePoint deserialization flaw that can enable remote code execution by an attacker authenticated as at least a Site Owner.
  • Microsoft updated its advisory to say exploitation of CVE-2026-58644 was detected; the flaw has a CVSS score of 9.8.
  • CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog and set a three-day patch deadline for federal agencies under BOD 26-04.
  • CISA also added FortiSandbox command-injection flaws CVE-2026-25089 and CVE-2026-39808, which can allow arbitrary code or command execution.
  • Exploit intelligence company Defused flagged both FortiSandbox flaws as exploited in the wild.

Article Details

Vulnerability Types
  • Deserialization of untrusted data
  • OS command injection
  • Security bypass
Severity
Critical; CVE-2026-58644 has a CVSS score of 9.8.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1210 · Exploitation of Remote ServicesThe article describes network-based exploitation of SharePoint to execute code remotely and exploitation of FortiSandbox flaws to execute code or commands on vulnerable appliances.

CVE

CVE-2026-25089The cybersecurity agency also added to the KEV list CVE-2026-25089 and CVE-2026-39808, two OS command injection flaws in Fortinet FortiSandbox that were patched in June and April.CVE-2026-39808The cybersecurity agency also added to the KEV list CVE-2026-25089 and CVE-2026-39808, two OS command injection flaws in Fortinet FortiSandbox that were patched in June and April.CVE-2026-55040defects, including CVE-2026-56164, which was flagged as exploited in the wild as a zero-day, and CVE-2026-55040, a critical security bypass weakness that could allow attackers to disclose files and modify data.CVE-2026-56164Microsoft’s security updates resolved several other SharePoint defects, including CVE-2026-56164, which was flagged as exploited in the wild as a zero-day, and CVE-2026-55040, a critical security bypass weakness thatCVE-2026-58644Tracked as CVE-2026-58644 (CVSS score of 9.8) and fixed as part of Microsoft’s July 2026 Patch Tuesday updates, the flaw is described as a deserialization of untrusted data issue.

Vendors

FortinetThe cybersecurity agency also added to the KEV list CVE-2026-25089 and CVE-2026-39808, two OS command injection flaws in Fortinet FortiSandbox that were patched in June and April.MicrosoftThreat actors have begun exploiting a fresh critical-severity remote code execution (RCE) vulnerability in Microsoft SharePoint, the US cybersecurity agency CISA warns.

Products

FortiSandboxThe cybersecurity agency also added to the KEV list CVE-2026-25089 and CVE-2026-39808, two OS command injection flaws in Fortinet FortiSandbox that were patched in June and April.Microsoft SharePointThreat actors have begun exploiting a fresh critical-severity remote code execution (RCE) vulnerability in Microsoft SharePoint, the US cybersecurity agency CISA warns.

Related Articles