Topic
CISA
CISA Adds JetBrains TeamCity CVE-2026-63077 to Known Exploited Vulnerabilities Catalog After Active Attacks
Vulnerabilities & Exploits
SOC Incident Analysis Exposes Active Exploitation of CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE
Vulnerabilities & Exploits
Russian State-Supported Group LAUNDRY BEAR Exploits Zero-Day CVE-2025-66376 in Zimbra Collaboration Suite
State-Sponsored & APTCISA Adds Three Exploited Vulnerabilities in FortiSandbox and SharePoint to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. Two of the flaws affect Fortinet’s FortiSandbox malware analysis product and involve OS command injection issues that can be triggered via specially crafted HTTP requests without requiring authentication. The third vulnerability impacts Microsoft SharePoint and stems from unsafe deserialization of untrusted data, potentially allowing remote code execution over the network. CISA’s action follows public advisories released by the vendors in April and June 2026. The agency is urging organizations to apply available patches and mitigations immediately to reduce the risk of compromise.
CISA Urges Immediate Patching as Multiple SharePoint Server Vulnerabilities Confirmed Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory after confirming active exploitation of multiple vulnerabilities in Microsoft SharePoint Server. Four specific CVEs have been added to the Known Exploited Vulnerabilities (KEV) catalog, with one additional flaw flagged by Microsoft as high-risk even without confirmed exploitation. Successful attacks can lead to remote code execution, theft of Internet Information Services (IIS) machine keys, establishment of persistent access, and deployment of malware. CISA recommends applying the latest Microsoft patches immediately, verifying successful installation, enabling the Antimalware Scan Interface (AMSI), and strengthening monitoring through Microsoft Defender Antivirus. Organizations are also advised to avoid direct internet exposure of SharePoint servers and to implement Layer 7 reverse proxies with enhanced logging to reduce the attack surface.
SonicWall Issues Emergency Hotfixes After Detecting Active Exploitation of Two Zero-Day Vulnerabilities in SMA1000 Appliances
SonicWall has confirmed active exploitation of two zero-day vulnerabilities in its SMA1000 series appliances, prompting the immediate release of hotfixes and a strict compliance deadline for U.S. federal agencies. The first flaw, CVE-2026-15409, carries a critical CVSS score of 10.0 and allows unauthenticated server-side request forgery (SSRF) through the Appliance Work Place interface, enabling attackers to force the device to make unauthorized requests to internal services. The second vulnerability, CVE-2026-15410, rated CVSS 7.2, permits authenticated code injection via the Appliance Management Console, allowing administrators to execute operating system commands. Affected models include SMA6210, SMA7210, and SMA8200v running specific vulnerable platform versions such as 12.4.3-03245 through 12.5.0-02800. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch or decommission impacted systems by July 17, 2026. Indicators of compromise and recommended response actions, including log analysis and potential appliance reimaging, have been published to help organizations detect and mitigate potential intrusions.