CISA Adds Actively Exploited Microsoft SharePoint Flaw to KEV Catalog
A deserialization vulnerability in Microsoft SharePoint is currently being exploited in the wild, prompting an urgent remediation deadline for federal agencies.
CISA has added CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) affecting Microsoft SharePoint, to its Known Exploited Vulnerabilities catalog. This security flaw allows an unauthorized attacker to execute code over a network, posing a significant risk to affected environments.
Because the vulnerability is being actively exploited in real-world attacks, federal agencies are required to apply vendor-provided mitigations by July 19, 2026. Organizations must follow CISA's BOD 26-04 guidance, which includes evaluating internet exposure and adhering to specific forensics triage requirements.
Sources
- CISA KEV Original source
Continue Reading
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.