CISA Adds Three Known Exploited Vulnerabilities to Catalog
2026-07-17T13:24:17Z•61de53c38c18c3d448367b4b23f46137c0738f799b1e7102ae2258d89c8635af
Access ControlBOD 26-04CISACSRFCommand InjectionDeserializationFortiSandboxFortinetKEV CatalogMicrosoft SharePointOracle E-Business SuiteRemote Code ExecutionSMA1000SSRFSharePointSonicWallUnrestricted File Uploadactive exploitationincident responsevulnerability management
What happened
CISA announced multiple additions to its Known Exploited Vulnerabilities (KEV) Catalog and issued a SharePoint hardening alert after evidence of active exploitation. Newly listed CVEs affect products including Fortinet FortiSandbox (command injection), Microsoft SharePoint (deserialization, RCE, missing authentication), SonicWall SMA1000 (SSRF, code injection), various web/plugins (unrestricted file upload, improper access control), Oracle E-Business Suite (improper privilege management), Cisco IOS (CSRF), KNX protocol, and others. CISA reiterates BOD 26-04 requirements for Federal Civilian ag
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 61de53c38c18c3d448367b4b23f46137c0738f799b1e7102ae2258d89c8635af
- Enrichment time
- 2026-07-17T13:24:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.