CISA Flags Three Actively Exploited Bugs in Fortinet and SharePoint

Key points

• CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, covering products from Fortinet and Microsoft.
• Two of the flaws, CVE-2026-25089 and CVE-2026-39808, sit in Fortinet FortiSandbox, a security appliance used to inspect suspicious files.
• The third, CVE-2026-58644, is a deserialization bug in Microsoft SharePoint, the widely used document and collaboration platform.
• Federal civilian agencies must patch quickly under Binding Operational Directive 26-04, which prioritises fixes for bugs on publicly exposed assets that would hand an attacker full control.
• CISA is urging all organisations, not just federal ones, to treat KEV Catalog bugs as top priority.

Three more bugs are on CISA's most-wanted list, and someone's already using them. The US Cybersecurity and Infrastructure Security Agency added the flaws to its Known Exploited Vulnerabilities Catalog, meaning there's evidence of active abuse in the wild, not just theoretical risk.

Two entries affect Fortinet FortiSandbox, a network appliance companies use to detonate suspicious files safely and check whether they behave like malware. Both, CVE-2026-25089 and CVE-2026-39808, are OS command injection bugs: an attacker can trick the device into running commands it was never meant to run, handing them a foothold inside the network. We first reported on CVE-2026-25089 on 10 June 2026, making this the third Threat Vectr story on that flaw.

The third entry is CVE-2026-58644, a deserialization of untrusted data flaw in Microsoft SharePoint. Deserialization bugs let an attacker feed a server a specially crafted data package that the software unpacks incorrectly, executing the attacker's code in the process. SharePoint is worth flagging separately: ransomware crews have long treated it as a fast path into corporate file stores, and Microsoft's July 2026 Patch Tuesday showed just how quickly new SharePoint flaws are now being found.

Should you worry?

Directly, not much, if you're a home user. These are enterprise products inside company and government networks. Indirectly, it matters: SharePoint servers hold sensitive internal documents, FortiSandbox sits at the edge of corporate networks seeing heavy traffic, and when attackers get into either, the fallout tends to arrive later as data leaks or breach notification letters.

Who has to act, and when?

US federal civilian agencies are on the clock. Binding Operational Directive 26-04 tells them to prioritise patching KEV Catalog bugs on systems exposed to the public internet that would give an attacker total control if broken into. The directive also requires agencies to check whether an attacker got in before the patch landed. Patching a machine that's already compromised locks the criminal inside with you.

Private companies, hospitals and local governments aren't bound by the directive. They're on the same internet, though, and CISA is urging every organisation to follow the same risk-based approach.

What should IT teams do now?

Check Fortinet's advisories and Microsoft's security update guide, apply the patches, and review logs for signs of prior intrusion. CISA didn't name specific groups exploiting these flaws and disclosed no victim counts. That's normal at this stage: the catalog listing is the signal. Someone is already using these to break into real systems.

Watch for incident-responder reporting in the coming weeks. That's usually when the victim profile becomes clearer.