Today’s Field Note

Two edge-facing platforms are burning at once. Microsoft SharePoint Server has CVE-2026-58644, a critical deserialization RCE (CVSS 9.8) that CISA added to the KEV catalog with an FCEB patch deadline of July 19, and it was exploited soon after disclosure. On the network side, CISA ordered agencies to patch two actively exploited Fortinet FortiSandbox flaws by Sunday. SharePoint remains a favorite because it sits internet-facing, holds sensitive documents, and organizations are chronically slow to patch it (see the ToolShell mess). The clock CISA set for federal agencies is the clock you should be running against too, deadlines are not a suggestion when a public exploit is already in play.

Today’s Action

  • Patch SharePoint Server for CVE-2026-58644 now. If you cannot patch today, restrict external access and rotate machine keys.
  • Hunt SharePoint for post-exploitation: unexpected w3wp.exe child processes, new .aspx files in LAYOUTS, and outbound connections from the SharePoint host.
  • Apply Fortinet FortiSandbox updates for the two KEV-listed flaws before Sunday, then audit management interface exposure.
  • Pull FortiSandbox and SharePoint logs for signs of authenticated access from unfamiliar accounts or IPs predating the patch.
  • Confirm your SharePoint instances are actually in your asset inventory. The one you forgot about is the one that gets hit.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch by Sunday, or explain by Monday.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.