As reported by Security Affairs, CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog to include newly confirmed flaws in Fortinet FortiSandbox and Microsoft SharePoint — both of which were addressed during Microsoft's July 2026 Patch Tuesday cycle. A KEV listing is not a routine administrative update; it represents CISA's formal acknowledgment that threat actors are actively weaponizing these vulnerabilities in the wild.

Security Impact: As reported by Security Affairs, CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog to include newly confirmed flaws in Fortinet FortiSandbox and Microsoft SharePoint — both of which were addressed during Microsoft's July 2026 Patch Tuesday cycle.

Vulnerability Snapshot

Affected Product #1:
Fortinet FortiSandbox — improper access control or authentication bypass (exact CVE pending full advisory confirmation)
Affected Product #2:
Microsoft SharePoint — Remote Code Execution (RCE) vulnerability, patched in the July 2026 Patch Tuesday release
Exploitation Status:
✅ Confirmed active exploitation — KEV listing is definitive confirmation
Patch Availability:
✅ Patches available — Microsoft July 2026 Patch Tuesday; Fortinet advisory via FortiGuard PSIRT
Federal Deadline:
CISA's Binding Operational Directive (BOD) 22-01 requires federal civilian agencies to remediate KEV-listed vulnerabilities within defined timeframes (typically 2–3 weeks)

Why This Combination Should Alarm Security Teams

The pairing of these two products in a single KEV update deserves closer scrutiny. FortiSandbox is a security control — it sits inside network defenses specifically designed to detect malicious files and behavior. When threat actors compromise a sandbox appliance, the implications extend well beyond the device itself: attackers may gain visibility into what files are being analyzed, potentially allowing them to identify ongoing incident response activities, exfiltrate sensitive detonated artifacts, or pivot deeper into an organization's security infrastructure.

SharePoint, meanwhile, remains one of the most broadly deployed collaboration platforms in enterprise and government environments globally. An RCE vulnerability in SharePoint is extraordinarily high-value for attackers — it offers a path to code execution on servers that typically hold sensitive documents, credentials cached in memory, and privileged service accounts. Historically, SharePoint RCE flaws have been favored by both nation-state actors and ransomware affiliates for initial access and lateral movement.

Shield53 Perspective: When CISA adds a vulnerability to the KEV catalog, the intelligence community has already observed exploitation. Organizations that delay patching beyond this point are accepting a known, quantified risk — not a theoretical one.

Who Is Most Exposed

Who Is Most Exposed
Federal civilian agencies: Mandatory remediation under BOD 22-01 — non-compliance carries regulatory consequences
Defense contractors and critical infrastructure operators: High-priority targets that commonly deploy both Fortinet security stacks and Microsoft SharePoint
Enterprises with internet-facing SharePoint deployments: Particularly SharePoint Server (on-premises) configurations, which lack the automatic update mechanisms of SharePoint Online
Organizations running FortiSandbox in analyst-facing or SOC-integrated roles: Compromise here could blind defenders at the worst possible moment
Managed Security Service Providers (MSSPs): Multi-tenant FortiSandbox deployments amplify the blast radius significantly

Shield53 Recommendations — Immediate Actions

For Microsoft SharePoint

  • Apply Microsoft's July 2026 Patch Tuesday updates to all SharePoint Server instances immediately — prioritize internet-facing deployments
  • Review SharePoint farm service account privileges and enforce least-privilege principles; an RCE exploit will execute in the context of the service account
  • Enable enhanced logging on SharePoint servers and forward logs to your SIEM — look for unusual process spawning from SharePoint worker processes (w3wp.exe)
  • Consider temporarily restricting external access to SharePoint if patching cannot be completed within 24–48 hours

For Fortinet FortiSandbox

  • Check the FortiGuard PSIRT advisory immediately and apply the recommended firmware update
  • Audit administrative access logs for any anomalous authentication events, especially from unusual source IPs or outside business hours
  • Segment FortiSandbox management interfaces from general network access — management planes should never be reachable from untrusted networks
  • Rotate all API keys and service credentials associated with FortiSandbox integrations as a precautionary measure

Broader Defensive Posture

  • Run an immediate asset inventory query for both product families across your environment — shadow IT instances of SharePoint are common in large enterprises
  • Threat hunt for indicators associated with these vulnerability classes using your EDR platform; look for web shell artifacts on SharePoint servers in particular
  • Verify your vulnerability management program has automated KEV catalog ingestion — manual tracking of CISA additions introduces dangerous lag time

The KEV catalog exists precisely because the patch-when-convenient approach has proven catastrophically insufficient. Organizations that align their remediation SLAs to confirmed exploitation evidence — rather than CVSS scores alone — will consistently outperform their peers in resilience. This week's additions are a clear signal: act now.