CISA Adds Microsoft SharePoint Deserialization Flaw to KEV Catalog
A critical deserialization vulnerability in Microsoft SharePoint is currently being exploited in the wild, requiring immediate action from federal agencies.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog. This flaw, identified as a deserialization of untrusted data vulnerability (CWE-502), allows an unauthorized attacker to execute code over a network.
CISA has confirmed that this vulnerability is being actively exploited in real-world scenarios. Federal agencies are required to apply necessary mitigations by July 19, 2026, in accordance with BOD 26-04. Stakeholders should evaluate the internet exposure of their assets and follow vendor instructions to secure their environments, or discontinue use of the product if mitigations are unavailable.
Sources
- CISA KEV Original source
Continue Reading
SecurityNewLXD, MicroCloud flaw lets clients be impersonated
Canonical patched a maximum-severity LXD and MicroCloud bug that let attackers assume a trusted client's identity without its private key.
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.