CISA Sets July 19 Deadline for SharePoint and FortiSandbox Flaws

# CISA Sets July 19 Deadline for SharePoint and FortiSandbox Flaws If you're reading this on the 19th, your window for the federal patch deadline has officially closed. Specifically, Microsoft SharePoint and Fortinet FortiSandbox are the priorities. If those aren't updated, you're essentially leaving the front door unlocked and putting a "Welcome" mat out for anyone with a basic script. The urgency here isn't just a bureaucratic deadline. We're seeing a tightening loop between disclosure and exploitation. CVE-2026-56164, a SharePoint flaw involving missing authentication, has already appeared in nearly 10 separate reports this week. That's a high signal. When a vulnerability hits the wire and is exploited almost immediately, the traditional "patch cycle" is dead. You can't wait for the next scheduled maintenance window. Let's talk about why CVE-2026-58644 is particularly nasty. It's a deserialization vulnerability. To a sysadmin, "deserialization" sounds like some abstract computer science jargon, but it's actually a very simple failure of trust. Think of serialization as flattening a complex object—like a Lego castle—into a set of instructions so it can be sent over a network. Deserialization is the process of reading those instructions to rebuild the castle. The flaw occurs when the application trusts the instructions implicitly. An attacker doesn't send a castle; they send a set of instructions that says, "While you're rebuilding this, please also open a reverse shell to my server." The application follows the instructions because it assumes the data is legitimate. It's not a failure of the encryption protecting the data in transit; it's a failure of the application to validate what it's rebuilding. This is where I see people get confused. They'll tell me they're safe because they use "military-grade encryption" for their data streams. I hate that phrase. "Military-grade" is marketing fluff used to distract you from the fact that the developers forgot to sanitize their inputs. You can use AES-256 to encrypt a payload, but if the application happily deserializes a malicious object once it's decrypted, the encryption didn't save you. It just ensured that only the intended recipient could be compromised. This isn't a crypto flaw; it's a fundamental key-management and trust flaw. Claude Shannon once noted that the essence of communication is the presence of uncertainty. Attackers love uncertainty, but they love predictable trust even more. Beyond the immediate SharePoint and Fortinet fires, there's a secondary tier. The SonicWall SMA1000 flaws (CVE-2026-15409 and 15410) had a deadline of the 17th. If you haven't hit those, you're already late. Then there's the Microsoft AD FS issue (CVE-2026-56155) and the Oracle E-Business Suite privilege flaw. These are serious, but they usually require a bit more positioning from the attacker. Then there's the noise. The KNX protocol flaw and the ancient Cisco IOS CSRF (from 2008, for some reason) just hit the KEV. Unless you're managing a very specific set of industrial building automations or running a museum of 2000s-era networking gear, these can wait until Monday. The real danger here is the second-order effect. We aren't just talking about a single server going down. Look at the FortiSandbox situation. These tools are often managed by Managed Service Providers (MSPs). If an MSP's sandbox is compromised via OS command injection, the attacker isn't just in the MSP's network—they have a potential bridge into every single client the MSP manages. The blast radius expands exponentially. Some will argue that a robust WAF or EDR setup mitigates these risks. They're wrong. WAFs are pattern-matchers; they look for known "bad" strings. A sophisticated deserialization attack can be wrapped in legitimate-looking objects that bypass pattern matching entirely. By the time your EDR flags the unusual process spawning from the web server, the attacker already has the tokens they need. This mirrors the 2023 MOVEit campaign. The difference is that back then, we had a few days to react. Now, we have hours. The cost to deploy these patches isn't the software—it's free. The real cost is about four hours of regression testing and the inevitable 15 minutes of downtime that will make your CFO grumpy. Pay it now, or pay the ransomware demand later.