CISA KEV Alert: Active Exploitation of Fortinet FortiSandbox and Microsoft SharePoint Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm by adding two critical security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This designation confirms that active exploitation is occurring in the wild, necessitating immediate action for all federal agencies and private sector organizations relying on these platforms. The updates involve a critical flaw in Microsoft SharePoint addressed in the July 2026 Patch Tuesday and a security issue in Fortinet FortiSandbox.

For defenders, this is not a drill. When a vulnerability hits the KEV catalog, the window for "patch management" transforms into "incident response prevention." We are observing threat actors actively scanning for and exploiting these weaknesses to establish initial access or move laterally within enterprise environments.

Technical Analysis

1. Microsoft SharePoint Unauthenticated Code Execution

Affected Product: Microsoft SharePoint Server (Enterprise/Standard).
Vulnerability Type: Remote Code Execution (RCE).
Authentication: Unauthenticated.
Patching Timeline: Addressed in Microsoft's July 2026 Patch Tuesday.
Exploitation Status: Confirmed Active Exploitation (Listed in CISA KEV).

Defender's Breakdown: This vulnerability represents a critical risk to enterprise collaboration infrastructure. As an unauthenticated RCE, it allows an attacker to execute arbitrary code on the SharePoint server without valid credentials. The flaw likely resides in how the web application parses specific incoming requests, potentially bypassing standard input sanitization checks. Successful exploitation typically grants the attacker the privileges of the SharePoint Application Pool account (often a service account with significant database and write access to the web root). This enables the immediate deployment of web shells or the dumping of user credentials via LSASS memory access if local privilege escalation is coupled with the attack.

2. Fortinet FortiSandbox Vulnerability

Affected Product: Fortinet FortiSandbox.
Vulnerability Type: Security Flaw (Details pending public release consistent with KEV protocols).
Exploitation Status: Confirmed Active Exploitation (Listed in CISA KEV).

Defender's Breakdown: FortiSandbox appliances are often positioned at the perimeter or in critical network segments to analyze suspicious files. A flaw here is high-value for attackers because it provides a trusted foothold within the security infrastructure itself. Exploitation could allow an adversary to escape the sandbox environment, manipulate analysis results to hide future malware, or pivot deeper into the internal network using the appliance's trusted connectivity.

Detection & Response

The following detection logic focuses on the behavioral indicators of exploitation for the SharePoint unauthenticated RCE, as this represents the most immediate widespread risk. For FortiSandbox, network anomalies and administrative access logging should be scrutinized.

Sigma Rules

YAML

---
title: Potential SharePoint Unauthenticated RCE Exploitation
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of unauthenticated RCE in SharePoint by identifying w3wp.exe spawning shells.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.initial_access
 - attack.t1190
 - attack.web_shell
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\w3wp.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 filter_legit:
   User|contains:
     - 'AUTHORITY\SYSTEM'
     - 'Administrators'
 condition: selection and not filter_legit
falsepositives:
 - Legitimate administrative troubleshooting via SharePoint Management Shell
level: high
---
title: Fortinet FortiSandbox Suspicious Administrative Activity
id: 9b3c4d5e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious command execution or file access patterns associated with FortiSandbox exploitation attempts.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|contains:
     - '/opt/fortinet'
     - '/forti'
   Image|endswith:
     - '/bin/sh'
     - '/bin/bash'
     - '/usr/bin/python'
   CommandLine|contains:
     - 'curl'
     - 'wget'
     - 'chmod 777'
 condition: selection
falsepositives:
 - Legitimate debugging by Fortinet support staff
level: medium

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for SharePoint IIS worker process spawning unauthorized shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
| where not(AccountName has "SYSTEM" or AccountName has "ADMIN")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| extend AlertDetail = "SharePoint w3wp.exe spawned shell process - Potential RCE"

Velociraptor VQL

VQL — Velociraptor

-- Hunt for web shell indicators in SharePoint directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\**\\*.aspx")
WHERE Mtime > now() - 7d
  AND Size < 5000
  -- Basic heuristic: new files created recently in web roots are suspicious

-- Hunt for w3wp.exe spawning command shells
SELECT Parent.Name, Parent.Pid, Pid, Name, CommandLine, StartTime
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe")

Remediation Script (PowerShell)

PowerShell

<#
.SYNOPSIS
    Checks for July 2026 SharePoint patches and attempts to identify potential web shells.
.DESCRIPTION
    This script verifies the installation of relevant updates (KB Placeholder) and scans for recent .aspx files.
#>

Write-Host "[*] Checking for July 2026 Security Updates..."

# Note: Replace KB###### with the actual KB number from the July 2026 advisory once released.
$RequiredKBs = @("KB5000000", "KB5000001") 
$InstalledUpdates = Get-HotFix | Select-Object -ExpandProperty HotFixID

$MissingPatches = $RequiredKBs | Where-Object { $_ -notin $InstalledUpdates }

if ($MissingPatches) {
    Write-Host "[!] CRITICAL: Missing security updates: $($MissingPatches -join ', ')" -ForegroundColor Red
} else {
    Write-Host "[+] All required security updates appear to be installed." -ForegroundColor Green
}

Write-Host "[*] Scanning for recently modified ASPX files (Potential Web Shells)..."

$WebRoots = @(
    "C:\inetpub\wwwroot",
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions",
    "$env:SystemDrive\inetpub"
)

$DateCutoff = (Get-Date).AddDays(-7)

foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Get-ChildItem -Path $Root -Filter *.aspx -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $DateCutoff -and $_.Length -lt 10kb } |
        Select-Object FullName, LastWriteTime, Length |
        Format-Table -AutoSize
    }
}

Write-Host "[+] Remediation Scan Complete."
Write-Host "[ACTION] If patches are missing, apply the July 2026 Cumulative Update immediately via WSUS or Microsoft Update."

Remediation

Immediate remediation is required for all affected organizations. CISA mandates that Federal Civilian Executive Branch (FCEB) agencies patch these vulnerabilities by the specified deadlines in the KEV catalog, but private sector entities should treat these deadlines as immediate action items given the confirmed active exploitation.

1. Microsoft SharePoint (July 2026 Patch Tuesday)

Patch: Apply the cumulative update for SharePoint Server released in July 2026 immediately.
Workaround: If patching is delayed, restrict access to SharePoint servers from untrusted networks (e.g., the internet) utilizing VPNs or Zero Trust Network Access (ZTNA) solutions.
Verification: Ensure the specific KB article for the July 2026 update is listed in "Installed Updates" on the server.
Vendor Advisory: Refer to the Microsoft Security Update Guide for the July 2026 release.

2. Fortinet FortiSandbox

Patch: Upgrade to the latest firmware version released by Fortinet that addresses this vulnerability.
Mitigation: Ensure management interfaces are not exposed to the internet. Enforce strict access control lists (ACLs) limiting management IP addresses to internal administration subnets only.
Verification: Check the Fortinet Support Advisories (PSA) for the specific version guidance and confirm the firmware version in the device dashboard.

3. Compromise Assessment Given the active exploitation status, organizations with internet-facing SharePoint or FortiSandbox instances should assume compromise and initiate a hunt for web shells (*.aspx, *.ashx files with recent timestamps) and suspicious scheduled tasks or persistent processes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub