CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-25089 | Unauthenticated OS Command Injection RCE in Fortinet FortiSandbox | 9.8 | 76% | KEV | KEV |
| CVE-2026-32201 | Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server | 6.5 | 43% | KEV | KEV |
| CVE-2026-39808 | Unauthenticated OS Command Injection in Fortinet FortiSandbox 4.4 | 9.8 | 93% | KEVPoC ×3 | KEV |
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation | 9.8 | 1% | KEV | KEV |
| CVE-2026-58644 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 | 16% | KEV | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jul 17, 2026 Vulnerability / Enterprise Security The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.