ACTIVELY EXPLOITED VULNERABILITIES ServiceNow AI Platform — Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, per threat intelligence firm Defused. Patch immediately. (SecurityWeek) SharePoint Server — CVE-2026-58644 was added to CISA's KEV catalog July 16 following active exploitation; CISA has urged SharePoint hardening, and the related FCEB patch deadline for the earlier SharePoint RCE (CVE-2026-45659) fell on July 19.

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-58644 — Microsoft SharePoint Server critical deserialization-of-untrusted-data vulnerability (CVSS 9.8) allowing unauthenticated remote code execution. Added to CISA's KEV catalog July 16; the FCEB patch deadline is today, July 19, 2026. (The Hacker News / CISA) SonicWall SMA 1000 zero-days — CVE-2026-15409 (unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (post-auth code injection in the Appliance Management Console, CVSS 7.2) a

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-58644 — Microsoft SharePoint Server, critical deserialization of untrusted data (CVSS 9.8) allowing unauthenticated remote code execution. Added to CISA's KEV catalog with an FCEB patch deadline of today, July 19, 2026. CISA also issued a separate alert urging SharePoint hardening after new exploitation activity. (The Hacker News, CISA) CVE-2026-25089 and CVE-2026-39808 — Fortinet FortiSandbox OS command injection flaws, added to th

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-58644 — Microsoft SharePoint Server deserialization of untrusted data (CVSS 9.8) added to CISA's KEV catalog following active exploitation; allows remote code execution by an attacker authenticated as Site Owner. FCEB patch deadline: July 19, 2026. CISA also issued SharePoint hardening guidance. (The Hacker News, CISA) SonicWall SMA1000 appliances — CVE-2026-15409 (server-side request forgery) and CVE-2026-15410 (code injection) add