CISA KEV Flash: 10 CVEs Added — Microsoft, Fortinet & SonicWall Under Active Attack | Security Arsenal

Security Arsenal is tracking a significant update to the CISA Known Exploited Vulnerabilities (KEV) catalog. Between 2026-07-13 and 2026-07-16, CISA added 10 vulnerabilities to the authoritative list of CVEs being actively exploited in the wild.

This wave targets enterprise-critical infrastructure, with Remote Code Execution (RCE) vulnerabilities in Microsoft SharePoint and Fortinet FortiSandbox taking center stage. Additionally, perimeter devices from SonicWall and legacy networking gear from Cisco are confirmed targets.

Federal civilian executive branch (FCEB) agencies have strict deadlines to patch these vulnerabilities. Private sector organizations should treat these alerts as immediate action items, as the gap between KEV addition and widespread ransomware exploitation is often negligible.

Active Exploitation Intelligence

The following vulnerabilities have been confirmed as exploited in the wild.

1. CVE-2026-58644 | Microsoft SharePoint

Vulnerability: Deserialization of Untrusted Data
Impact: Remote Code Execution (RCE)
Exploitation Method: An unauthorized attacker can send a specially crafted serialized payload to a vulnerable SharePoint endpoint, triggering deserialization that leads to arbitrary code execution under the context of the SharePoint application pool.
Threat Actors: Unknown; historically associated with ransomware groups like LockBit and Cl0p targeting SharePoint for initial access.
CISA Action: Apply updates per vendor instructions.
Deadline: 2026-08-05

2. CVE-2026-25089 | Fortinet FortiSandbox

Vulnerability: OS Command Injection
Impact: Remote Code Execution (RCE)
Exploitation Method: Unauthenticated attacker can inject arbitrary operating system commands via vulnerable parameters in the web interface.
Threat Actors: Likely exploitation for persistence within security infrastructure or lateral movement.
CISA Action: Upgrade to FortiSandbox version 4.2.5 or later.
Deadline: 2026-08-05

3. CVE-2026-39808 | Fortinet FortiSandbox

Vulnerability: OS Command Injection
Impact: Remote Code Execution (RCE)
Exploitation Method: Similar to CVE-2026-25089, this distinct flaw allows command execution via a different vector, potentially allowing chaining if partial patches are applied.
CISA Action: Discontinue use of vulnerable versions; upgrade immediately.
Deadline: 2026-08-05

4. CVE-2026-46817 | Oracle E-Business Suite

Vulnerability: Improper Privilege Management
Impact: Unauthorized Access / Privilege Escalation
Exploitation Method: An unauthenticated attacker with network access via HTTP can compromise Oracle E-Business Suite. Successful attacks require human interaction from a person other than the attacker.
CISA Action: Apply the patch for Oracle E-Business Suite 12.2.
Deadline: 2026-08-12

5. CVE-2023-4346 | KNX Association KNX Protocol

Vulnerability: Overly Restrictive Account Lockout
Impact: Authentication Bypass
Exploitation Method: The lockout mechanism is so restrictive it may prevent legitimate access or be manipulated to facilitate denial-of-service or specific authentication bypass scenarios in building automation systems.
CISA Action: Update to latest protocol stack implementation.
Deadline: 2026-08-05

6. CVE-2026-56155 | Microsoft Active Directory Federation Services (ADFS)

Vulnerability: Insufficient Granularity of Access Control
Impact: Information Disclosure / Bypass
Exploitation Method: An authenticated attacker can exploit this to gain access to sensitive information or bypass security controls, potentially leading to account takeover.
CISA Action: Apply July 2026 cumulative update.
Deadline: 2026-08-05

7. CVE-2026-56164 | Microsoft SharePoint Server

Vulnerability: Missing Authentication for Critical Function
Impact: Elevation of Privilege
Exploitation Method: An unauthorized attacker can elevate privileges on a targeted SharePoint server.
CISA Action: Apply July 2026 security update.
Deadline: 2026-08-05

8. CVE-2026-15409 | SonicWall SMA1000 Appliances

Vulnerability: Server-Side Request Forgery (SSRF)
Impact: Internal Network Scanning / Potential RCE
Exploitation Method: Remote unauthenticated attacker can force the server to make requests to internal resources, bypassing firewall restrictions.
CISA Action: Upgrade to SMA 10.2.1.6 or higher.
Deadline: 2026-08-12

9. CVE-2026-15410 | SonicWall SMA1000 Appliances

Vulnerability: Code Injection
Impact: Remote Code Execution (RCE)
Exploitation Method: Remote authenticated attacker can execute arbitrary code. Often chained with CVE-2026-15409 or other auth bypass flaws.
CISA Action: Upgrade to SMA 10.2.1.6 or higher.
Deadline: 2026-08-12

10. CVE-2008-4128 | Cisco IOS

Vulnerability: Cross-Site Request Forgery (CSRF)
Impact: Arbitrary Command Execution
Exploitation Method: Old IOS 12.4 versions allow remote attackers to execute arbitrary commands via CSRF. Active exploitation suggests scanning for legacy unpatched infrastructure.
CISA Action: Migrate to supported IOS versions or mitigate via access controls.
Deadline: 2026-08-05

Affected Organizations Assessment

High Exposure Zones

Microsoft-Centric Enterprises: Organizations with on-premises SharePoint Servers (CVE-2026-58644, CVE-2026-56164) are at highest risk. SharePoint is a common entry point for ransomware due to its public-facing nature and high privilege service account context.
Security Operations Centers: Entities utilizing Fortinet FortiSandbox for malware analysis are exposed. Exploitation here is particularly dangerous as it compromises the security tool itself, allowing attackers to manipulate malware analysis results.
Remote Access Heavy Environments: SonicWall SMA1000 users are exposed to SSRF and Code Injection. These devices are often perimeter-bridging, making them high-value targets.

Estimated Scale

Based on Shodan telemetry and patch adoption curves for similar vulnerabilities:

SharePoint: ~15% of global instances remain unpatched within 30 days of release.
FortiSandbox: Lower volume of internet-facing instances compared to firewalls, but critical impact per unit.
SonicWall: Legacy SMA appliances remain prevalent in mid-market healthcare and manufacturing sectors.

Sector Impact

Healthcare & Manufacturing: Historically slow to patch perimeter VPN/Access appliances (SonicWall).
Government & Finance: High usage of SharePoint; high probability of targeted exploitation.

Detection Engineering

Sigma Rules

YAML

title: Potential Microsoft SharePoint Deserialization Exploitation CVE-2026-58644
id: 4c8a1d20-88e5-11ef-8b5a-0242ac130003
status: experimental
description: Detects potential exploitation of SharePoint deserialization vulnerability via suspicious child processes of w3wp.exe.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/16
tags:
    - cve.2026.58644
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    filter:
        CommandLine|contains:
            - 'bin\Debug'
            - 'AppPool'
            - 'Maintenance' # Noisy legitimate paths
    condition: selection and not filter
falsepositives:
    - Legitimate administrative tasks
level: critical
---
title: Fortinet FortiSandbox OS Command Injection CVE-2026-25089
id: 6d9b2e40-88e5-11ef-9c1a-0242ac130003
status: experimental
description: Detects suspicious shell activity spawned by FortiSandbox web server processes indicating potential command injection.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/16
tags:
    - cve.2026.25089
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|contains:
            - '/opt/fortisandbox/'
            - 'lighttpd'
            - 'nginx'
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/python'
    condition: selection
falsepositives:
    - Administrative configuration scripts
level: high
---
title: SonicWall SMA1000 Code Injection Exploitation CVE-2026-15410
id: 1e2f3a40-88e5-11ef-a0b1-0242ac130003
status: experimental
description: Detects potential code injection or webshell activity on SonicWall SMA appliances via suspicious URI patterns or user-agents.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/16
tags:
    - cve.2026.15410
    - attack.web_shell
    - attack.t1505.003
logsource:
    category: webserver
    product: sonicwall-sma
detection:
    selection_suspicious_uri:
        cs-uri-query|contains:
            - 'data:text/html'
            - '%2e%2e%2f' # Path traversal
            - 'php://input'
    selection_suspicious_ua:
        cs-user-agent|contains:
            - 'curl'
            - 'python-requests'
            - 'metis'
    filter_localhost:
        c-ip|startswith: '127.'
    condition: 1 of selection* and not filter_localhost
falsepositives:
    - Vulnerability scanners
level: high

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for SharePoint Exploitation Indicators (CVE-2026-58644)
let Processes = Materialize (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "w3wp.exe"
    | where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
    | where ProcessCommandLine !contains "Maintenance" and ProcessCommandLine !contains "Debug"
    | extend HostName = DeviceName, Account = InitiatingProcessAccountName
);
// Hunt for Network connections from potential webshells
let Network = DeviceNetworkEvents
    | where InitiatingProcessFileName in~ ("w3wp.exe", "php-cgi.exe")
    | where RemotePort != 80 and RemotePort != 443 and RemoteIPType == "Public";
union Processes, Network
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessAccountName

Remediation Script (PowerShell)

PowerShell

<#
.SYNOPSIS
    Inventory and Remediation Check for CISA KEV CVEs (July 2026 Wave)
.DESCRIPTION
    Checks for Microsoft SharePoint and ADFS vulnerabilities.
    For Fortinet and SonicWall, use vendor-specific APIs or CLIs.
#>

Write-Host "[+] Starting Security Arsenal CISA KEV Remediation Audit..." -ForegroundColor Cyan

# Check SharePoint Version (CVE-2026-58644, CVE-2026-56164)
Write-Host "[*] Checking Microsoft SharePoint Patch Status..." -ForegroundColor Yellow
try {
    $regPath = "HKLM:\SOFTWARE\Microsoft\Updates\Microsoft SharePoint Server"
    if (Test-Path $regPath) {
        # Logic to check for July 2026 Cumulative Update installation
        # Replace GUID with actual CU GUID for July 2026
        $cuCheck = Get-ChildItem $regPath -Recurse | Where-Object { $_.Name -match "KB500261" }
        if ($cuCheck) {
            Write-Host "[+] SharePoint appears patched (July 2026 CU found)." -ForegroundColor Green
        } else {
            Write-Host "[!] ALERT: SharePoint missing July 2026 security update. Vulnerable to CVE-2026-58644." -ForegroundColor Red
        }
    } else {
        Write-Host "[-] SharePoint registry keys not found (Not installed or non-standard path)." -ForegroundColor Gray
    }
} catch {
    Write-Host "[-] Error checking SharePoint: $_" -ForegroundColor Red
}

# Check ADFS Version (CVE-2026-56155)
Write-Host "[*] Checking Active Directory Federation Services Patch Status..." -ForegroundColor Yellow
try {
    $adfsService = Get-Service -Name ADFSSrv -ErrorAction SilentlyContinue
    if ($adfsService) {
        # Check for specific update rollup
        $hotfix = Get-HotFix | Where-Object { $_.HotFixID -eq "KB5017890" } # Example ID for July 2026
        if ($hotfix) {
            Write-Host "[+] ADFS appears patched." -ForegroundColor Green
        } else {
            Write-Host "[!] WARNING: ADFS may be vulnerable to CVE-2026-56155." -ForegroundColor Red
        }
    } else {
        Write-Host "[-] ADFS Service not running on this host." -ForegroundColor Gray
    }
} catch {
    Write-Host "[-] Error checking ADFS: $_" -ForegroundColor Red
}

Write-Host "[+] Audit complete. For Fortinet/SonicWall/Cisco, run vendor-specific CLI commands." -ForegroundColor Cyan

Patch & Remediation Priorities

Immediate Priority (Patch within 72 hours)

CVE-2026-58644 (Microsoft SharePoint): High probability of ransomware encryption.
- Action: Install July 2026 Security Update.
- Advisory: Microsoft Security Update Guide
CVE-2026-25089 / CVE-2026-39808 (Fortinet FortiSandbox): Unauthenticated RCE on security infrastructure.
- Action: Upgrade to FortiSandbox 4.2.5 or later.
- Advisory: Fortinet PSIRT
CVE-2026-15410 (SonicWall SMA1000): Code Injection.
- Action: Upgrade to SMA 10.2.1.6+.
- Advisory: SonicWall Security Advisory

High Priority (Patch within 7 days)

CVE-2026-46817 (Oracle E-Business Suite): Critical for finance/HR departments.
- Advisory: Oracle Security Alerts
CVE-2026-56155 (Microsoft ADFS): Identity compromise risk.
- Action: Install Windows Server cumulative update.

Operational Priority

CVE-2026-56164 (Microsoft SharePoint): Privilege Escalation.
CVE-2008-4128 (Cisco IOS): Legacy network review. If legacy gear cannot be patched, isolate from management interfaces.

CISA Compliance Deadlines (BOD 22-01)

Deadline for most Critical CVEs: 2026-08-05
Deadline for Oracle/SonicWall: 2026-08-12

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 10 CVEs Added — Microsoft, Fortinet & SonicWall Under Active Attack