Ethical Hacking News
U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog; Organizations must take prompt action to fix identified vulnerabilities in their infrastructure.
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089), Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644) and an OS command injection flaw tracked as CVE-2026-39808 have been added to the U.S. CISA's KEV catalog. These vulnerabilities can be exploited by remote, unauthenticated attackers who send specially crafted HTTP requests and execute arbitrary commands on affected devices. The KEV catalog serves as a resource for federal agencies to identify and address known exploited vulnerabilities within their networks. Federal agencies are required to fix these flaws by July 19, 2026, to safeguard U.S. critical infrastructure and prevent potential attacks.
U.S. CISA, the Cybersecurity and Infrastructure Security Agency, has added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the importance of addressing security threats in a timely manner. The latest additions include Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089), Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644), and an OS command injection flaw tracked as CVE-2026-39808, both in FortiSandbox products.
According to the CISA, these vulnerabilities can be exploited by remote, unauthenticated attackers who send specially crafted HTTP requests and execute arbitrary commands on affected devices. The Fortinet FortiSandbox vulnerability, for instance, was discovered by Adham El Karn of Fortinet's Product Security team and confirmed by Cybersecurity firm Defused Cyber to have been actively exploited within a 24-hour window.
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644) is another critical vulnerability added to the KEV catalog. This bug can be triggered without authentication or user interaction, stemming from the deserialization of untrusted data in Microsoft Office SharePoint. The CISA advises that an attacker authenticated as at least a Site Owner could execute arbitrary code remotely on the SharePoint Server.
The KEV catalog, maintained by CISA, serves as a resource for federal agencies to identify and address known exploited vulnerabilities within their networks. Experts recommend that private organizations review this catalog and take prompt action to fix identified vulnerabilities in their infrastructure. The Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities requires FCEB agencies to address these vulnerabilities by the due date.
U.S. CISA has issued a call for federal agencies to urgently fix these flaws by July 19, 2026, as highlighted in their latest alert. This proactive step underscores the agency's commitment to safeguarding U.S. critical infrastructure and preventing potential attacks exploiting these known vulnerabilities.
Additionally, cybersecurity firms like Defused Cyber have been actively monitoring the threat landscape and providing alerts on newly discovered vulnerabilities and their associated risks. These efforts demonstrate the importance of ongoing vigilance in addressing emerging security threats and maintaining the integrity of digital systems.
In summary, Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089), Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644), and an OS command injection flaw tracked as CVE-2026-39808 have been added to the U.S. CISA's Known Exploited Vulnerabilities catalog, underscoring the urgency for organizations to address these vulnerabilities in their networks.
U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog; Organizations must take prompt action to fix identified vulnerabilities in their infrastructure.
Related Information:
https://www.ethicalhackingnews.com/articles/The-US-CISA-Adds-Fortinet-FortiSandbox-and-Microsoft-SharePoint-Vulnerabilities-to-its-Known-Exploited-Vulnerabilities-Catalog-ehn.shtml
https://securityaffairs.com/195569/security/u-s-cisa-adds-fortinet-fortisandbox-and-microsoft-sharepoint-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-25089
https://www.cvedetails.com/cve/CVE-2026-25089/
https://nvd.nist.gov/vuln/detail/CVE-2026-58644
https://www.cvedetails.com/cve/CVE-2026-58644/
https://nvd.nist.gov/vuln/detail/CVE-2026-39808
https://www.cvedetails.com/cve/CVE-2026-39808/
Published: Sat Jul 18 08:14:37 2026 by llama3.2 3B Q4_K_M
