CISA Adds CVE-2026-58644 SharePoint RCE Zero-Day and Two Fortinet FortiSandbox Flaws to KEV

CVE-2026-58644 is a deserialization of untrusted data vulnerability (CWE-502) in on-premises Microsoft SharePoint Server, scored CVSS 9.8. Microsoft confirmed active zero-day exploitation before patches released July 14; an attacker needs authentication at the Site Owner level to trigger repeatable remote code execution with low complexity. The vulnerability joins four others in an active SharePoint exploitation cluster, with four now listed on CISA KEV under a July 19 federal deadline. Rapid7's Emergent Threat Response documents three Microsoft Defender and AMSI detection signatures for the exploitation: Exploit:Script/SuspSignoutReqBody.A for Subscription Edition request-body scanning, plus Exploit:Script/ToolPaneAuthBypass.A and Exploit:Script/ToolPaneAuthBypass for request-header scanning across 2016, 2019, and Subscription Edition.

The attacker profile changes this from a routine server patch into an immediate incident-response trigger. A Site Owner-privileged attacker achieving RCE inside SharePoint can pivot through the application tier, access document repositories, and move laterally through federated identity paths. The cluster now covers five CVEs, meaning defenders face not a single missed patch but a sustained exploitation pattern that has outpaced the vendor's release cycle. The July 19 deadline is tomorrow; agencies that miss it remain exposed to an unauthenticated command-injection pathway on Fortinet FortiSandbox (CVE-2026-25089 and CVE-2026-39808) as well, where patches from April 14 and June 9 did not prevent exploitation first observed by Defused on June 16. The overlap of SharePoint RCE and unauthenticated FortiSandbox RCE in a single BOD 26-04 cycle means resource-constrained security operations must split attention between application-layer deserialization and network-edge remote code execution at the same time.

Enable AMSI Full Mode on every SharePoint web application, apply the three Rapid7-documented signatures, and initiate incident response if any exploitation artifacts are detected. Apply the July 14 SharePoint patches immediately; for FortiSandbox, confirm CVE-2026-39808 (patched April 14) and CVE-2026-25089 (patched June 9) are deployed. Hunt for exploitation artifacts tied to deserialization payloads in SharePoint request bodies and headers; scan for the specific AMSI signatures rather than generic malware indicators. Restrict SharePoint web application access to the minimum privileged account set needed, and review Site Owner role assignments for unauthorized escalation.

Watch whether Microsoft expands the patch coverage to additional SharePoint versions beyond Subscription Edition and 2016/2019, and whether CISA extends the July 19 deadline or adds further CVEs from the same cluster to KEV. A second wave of exploitation telemetry after the deadline, or confirmation of in-the-wild use of the AMSI-bypass variants, would change both the severity and the defensive priority of this cluster.