CISA Adds Three Actively Exploited Fortinet and Microsoft SharePoint Vulnerabilities to KEV Catalog
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) announced that three CVEs have been added to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation: two Fortinet FortiSandbox OS command‑injection flaws (CVE‑2026‑25089, CVE‑2026‑39808) and a Microsoft SharePoint deserialization of untrusted data flaw (CVE‑2026‑58644).
Exploitability — All three vulnerabilities are documented as being exploited in the wild; no public proof‑of‑concept is required to confirm risk. CISA’s inclusion in the KEV catalog signals a high likelihood of successful compromise if unpatched.
Affected Products
- Fortinet FortiSandbox (OS command injection) – CVE‑2026‑25089, CVE‑2026‑39808
- Microsoft SharePoint (deserialization of untrusted data) – CVE‑2026‑58644
Why It Matters for Compliance & Audit Readiness
- SOC 2 Control CC6.1 (Vulnerability Management) – Demonstrating timely identification and remediation of known‑exploited flaws is a core audit evidence point.
- Continuous Monitoring – Automated evidence of patch status and remediation timelines satisfies both internal risk programs and external auditors demanding a defensible remediation trail.
- Risk‑Based Prioritization – Aligning remediation with CISA’s BOD 26‑04 mirrors the risk‑scoring approach required by many SOC 2‑compliant organizations, reinforcing due‑diligence expectations from enterprise customers.
Recommended Actions
- Verify whether any public‑facing assets run the listed FortiSandbox or SharePoint versions.
- Prioritize patching of CVE‑2026‑25089, CVE‑2026‑39808, and CVE‑2026‑58644 in accordance with BOD 26‑04 deadlines.
- Record remediation steps in your change‑management system and capture scan results as immutable audit evidence.
- Integrate a continuous‑vulnerability‑scanning tool that flags KEV‑catalog entries automatically.
Source: CISA Advisory – July 16 2026