Weekly Threat Bulletin – July 22nd, 2026

CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation

On July 16, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate them by July 19, 2026. The first is CVE-2026-58644 (CVSS 9.8), a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server 2016 and Enterprise Server 2016 that allows network-based remote code execution, though Microsoft notes it requires at least Site Owner privileges. The other two are CVSS 9.1 OS command injection vulnerabilities affecting Fortinet FortiSandbox: CVE-2026-25089 (affecting versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2, and Cloud/PaaS 5.0.4-5.0.5), which allows unauthenticated command execution via crafted HTTP requests, and CVE-2026-39808 (affecting versions 4.4.0-4.4.8). Both Fortinet and Microsoft have released patches to address these flaws, and organizations are urged to apply these updates immediately, particularly as July 2026 marked the end of support for SharePoint Server 2016 and 2019.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the July 2026 security updates from Microsoft to all SharePoint servers to remediate CVE-2026-58644.
• Immediately apply the latest security updates from Fortinet to all FortiSandbox appliances to remediate CVE-2026-25089 and CVE-2026-39808.
• Review network and appliance logs for any unusual or crafted HTTP requests targeting FortiSandbox management interfaces, which could indicate attempted or successful exploitation of CVE-2026-25089 or CVE-2026-39808.
• Hunt for indicators of compromise on SharePoint servers, such as suspicious processes spawned by the SharePoint application pool, unexpected file modifications, or anomalous network connections, related to CVE-2026-58644.

Compliance Best Practices

• Develop and execute a formal project plan to migrate from end-of-support SharePoint Server 2016 and 2019 instances to a fully supported version or a cloud-based alternative to ensure ongoing security updates.
• Review and implement network segmentation and access control lists (ACLs) to ensure that management interfaces for all security appliances, including FortiSandbox, are only accessible from a dedicated, secure management network or a limited set of trusted administrative IP addresses.
• Conduct a comprehensive audit of all SharePoint user permissions and implement a policy of least privilege, specifically minimizing the number of accounts with 'Site Owner' or equivalent administrative rights.

WordPress 7.0.2 Fixes Critical Unauthenticated RCE Chain

On July 17, 2026, WordPress released version 7.0.2 to address a critical two-stage vulnerability chain that enables unauthenticated remote code execution and full site takeover. The first vulnerability, CVE-2026-60137, is a high-severity facilitated SQL injection in `WP_Query` affecting versions 6.8 through 7.0.1. It occurs because the `is_array()` check on the `author__not_in` query variable can be bypassed if the input is a string, skipping `absint` sanitization and concatenating the raw input directly into the SQL WHERE clause. The second vulnerability, CVE-2026-63030, is a critical REST API batch route/handler confusion flaw affecting versions 6.9 through 7.0.1 within ``WP_REST_Server::server_batch_request_v1()`.` By seeding a batch request with an invalid sub-request, an attacker causes an index desynchronization that shifts handler lookups, unbinding validation from execution and allowing an unauthenticated `GET` request with a malicious `author_exclude` payload to bypass validation and trigger the SQL injection. WordPress 7.0.2 and backported versions 6.9.5 and 6.8.6 resolve these issues by routing query variables through ``wp_parse_id_list()`,` maintaining index alignment for batch errors, and implementing a re-entrancy guard to prevent nested dispatches.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Update all WordPress instances to a patched version immediately. Use version 7.0.2, 6.9.5, or 6.8.6, depending on your current branch.
• Immediately audit all WordPress sites for any recently created or unrecognized user accounts, especially those with administrative privileges. Remove any suspicious accounts found.
• If patching is delayed, configure the Web Application Firewall (WAF) to block all incoming requests to the WordPress REST API batch endpoint, which typically uses the path `/wp-json/batch/v1`.

Compliance Best Practices

• Implement and enable an automated patch management policy for WordPress core installations to ensure critical security updates are applied as soon as they are released, without manual intervention.
• Ensure the company's Web Application Firewall (WAF) is configured with a virtual patching service that automatically receives and applies rule sets to block exploits against common platforms like WordPress.
• Establish a recurring process to review WordPress configurations and disable any non-essential features or API endpoints, such as the REST API if it is not required for business operations, to reduce the overall attack surface.
• Deploy a security monitoring tool or script that automatically generates an alert for the security team whenever a new user account, especially an administrator, is created on any company WordPress site.

OAuth Client ID Spoofing Enables Stealthy Cloud Account Enumeration

Threat actors are increasingly utilizing OAuth client ID spoofing to stealthily enumerate Microsoft Entra ID accounts and validate credentials while evading traditional authentication-based detection. By supplying fabricated or stolen globally unique identifiers (GUIDs) instead of legitimate registered application IDs, attackers cause the application name field in Entra sign-in logs to remain blank, stripping defenders of critical visibility. Two massive campaigns have been identified leveraging this technique: `UNK_pyreq2323,` which began in January 2026, operated from Amazon Web Services (AWS) infrastructure using a Python user agent to target over 1 million accounts across 4,000 tenants; and `UNK_OutFlareAZ,` which began in December 2025, operated from Cloudflare infrastructure using a Microsoft Outlook user agent to target over 2 million users with 3.7 million unique, randomly generated spoofed application IDs. To mitigate this stealthy reconnaissance, organizations must monitor Entra sign-in logs for blank application names, missing application IDs, and AADSTS700016 error codes, while implementing phishing-resistant multi-factor authentication (MFA), disabling legacy authentication, and enforcing risk-based Conditional Access policies.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Create a detection rule in your SIEM or Microsoft Sentinel to alert on Microsoft Entra ID sign-in events where the 'Application' name field is blank and the sign-in status is 'Failure'.
• Create a detection rule to alert on Microsoft Entra ID sign-in failures with the error code AADSTS700016, which indicates an attempt to use an unregistered application.
• Search Microsoft Entra ID sign-in logs for authentication attempts using the user agent 'python-requests/2.32.3' and investigate any findings.
• Use Microsoft Entra Conditional Access to block legacy authentication protocols such as POP, IMAP, and SMTP, which do not support modern security controls like MFA.
• Audit your Microsoft Entra tenant for applications using the OAuth Resource Owner Password Credentials (ROPC) grant flow and disable it for any non-essential applications.

Compliance Best Practices

• Develop and execute a phased rollout plan to implement phishing-resistant multi-factor authentication (MFA) using FIDO2 security keys or passkeys for all users, prioritizing administrators and executives.
• Enhance Microsoft Entra Conditional Access policies to require access from compliant devices and trusted network locations for all cloud applications.
• Implement and tune Microsoft Entra Identity Protection to build risk-based Conditional Access policies that automatically enforce stricter controls, like MFA re-authentication or access blocks, when a high-risk sign-in or user is detected.
• Establish a recurring schedule for tabletop exercises that simulate identity-based attacks, such as large-scale account enumeration and MFA bypass, to test and improve your incident response procedures.
• Integrate Microsoft Defender XDR alerts and identity telemetry into your SIEM to correlate endpoint, email, and identity signals for a more comprehensive view of potential attacks.

CISA Orders Feds to Patch Actively Exploited Oracle Flaw by Saturday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies secure their systems by Saturday, July 18, against ongoing attacks exploiting a critical vulnerability in the Oracle E-Business Suite (EBS) financial application. This flaw, tracked as CVE-2026-46817, resides in the File Transmission component of EBS's Oracle Payments product and enables unauthenticated threat actors with HTTP network access to compromise vulnerable systems through low-complexity attacks. Oracle released security updates for this issue in its May 2026 Critical Security Patch Update, urging immediate application. While Oracle had not officially flagged it as exploited, threat intelligence firm Defused reported active exploitation in the wild since June 29, noting the absence of public proof-of-concept code. CISA confirmed the active exploitation, adding CVE-2026-46817 to its list of known exploited security flaws, and issued the patching directive under Binding Operational Directive (BOD) 26-04. Internet security watchdog Shadowserver identifies over 1,000 Internet-exposed Oracle EBS instances, with more than half located in the United States. This action follows previous CISA orders to patch other actively exploited Oracle vulnerabilities, including CVE-2025-61884 in Oracle E-Business Suite and CVE-2024-21182 in Oracle WebLogic Server, highlighting a pattern of 43 Oracle security issues flagged by CISA as exploited in the wild, with 12 abused by ransomware groups.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the Oracle May 2026 Critical Security Patch Update to all Oracle E-Business Suite instances to remediate CVE-2026-46817.
• Use vulnerability scanners and asset inventory tools to identify all Oracle E-Business Suite instances within the environment.
• If immediate patching is not possible, use firewalls to restrict all HTTP and HTTPS access to Oracle E-Business Suite instances, allowing connections only from trusted internal IP addresses.
• Review web server and application logs for all Oracle E-Business Suite instances for anomalous requests targeting Oracle Payments components to detect signs of compromise.

Compliance Best Practices

• Establish and enforce a formal patch management policy that mandates specific timelines for applying security updates based on vulnerability severity, especially for critical enterprise applications like Oracle E-Business Suite.
• Develop a network segmentation strategy to ensure critical financial applications, such as Oracle E-Business Suite, are not directly exposed to the internet.
• Mandate that all remote access to internal enterprise applications is performed through a secure VPN with multi-factor authentication.
• Implement a centralized asset management system to maintain a real-time, accurate inventory of all software and their versions, automating the discovery process for systems like Oracle E-Business Suite.
• Incorporate the CISA Known Exploited Vulnerabilities (KEV) catalog feed into the vulnerability management workflow to automatically prioritize patching efforts.

Inc Ransomware Exploits SonicWall SMA Zero-Days

The Inc ransomware-as-a-service (RaaS) group has been actively exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SonicWall Secure Mobile Access (SMA) 1000 Series appliances to gain root-level remote code execution. CVE-2026-15409 is a critical server-side request forgery (SSRF) flaw in the "Work Place" web interface with a CVSS score of 10.0 that requires no authentication, while CVE-2026-15410 is a high-severity code injection vulnerability (CVSS 7.2) in the Appliance Management Console. By chaining these vulnerabilities, threat actors establish initial access, bypass input validation controls, and harvest credentials, active session databases, and one-time login seeds before moving laterally to domain controllers to deploy ransomware. Although SonicWall has released hotfixes and the Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, organizations must perform comprehensive forensic reviews alongside patching, as attackers have been observed rolling back newly applied patches on compromised devices to maintain persistence.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the hotfix from SonicWall for vulnerabilities CVE-2026-15409 and CVE-2026-15410 on all SonicWall Secure Mobile Access (SMA) 1000 Series appliances.
• Perform a forensic review of all SonicWall SMA 1000 appliances to hunt for indicators of compromise, such as unauthorized configuration changes, credential theft, or evidence of patch rollbacks.
• Review authentication logs on domain controllers and other critical servers for any suspicious access attempts originating from the IP addresses of your SonicWall SMA appliances.

Compliance Best Practices

• Establish and enforce a strict vulnerability management policy that prioritizes rapid patching for all internet-facing systems and network edge devices.
• Implement network segmentation to restrict network traffic from edge appliances, ensuring they can only communicate with necessary internal resources and are blocked from accessing critical assets like domain controllers and backup servers.
• Ensure all edge devices, including SonicWall SMAs, forward comprehensive logs to a central SIEM and develop specific detection rules to alert on suspicious activities like large data transfers, access to credential stores, or unusual administrative commands.
• Review and update your incident response plan to include a specific playbook for compromises of network edge devices, detailing steps for isolation, forensic data collection, and eradication of persistent threats.