Our takeCISA is urging immediate patches for three SharePoint vulnerabilities under active exploitation, two of them used as zero-days. If you run SharePoint and it is reachable, treat this as urgent and apply the fixes now.Security Resilience desk
Sources (2)
- securityweek · securityweek
- bleeping · bleeping
What this means for you — Security leader:CISA lists three SharePoint CVEs as actively exploited, two as zero-days, alongside a separate order to patch two exploited Fortinet FortiSandbox flaws by Sunday. Check both against your patch tracker now — federal deadlines are a floor, not a ceiling, for exposure windows this active.
What this means for you — Lean IT orgs:If you run Microsoft SharePoint (on-premises, not the cloud version) or a Fortinet FortiSandbox appliance, attackers are already using known bugs to break in — update now, don't wait for a slow patch cycle.
What this means for you — MSP:Two separate CISA push notices this week: SharePoint (three CVEs, two zero-days) and FortiSandbox (two CVEs, deadline Sunday). Pull an inventory across client environments for both products and confirm patch status — this is a two-front fire drill, not one.
What this means for you — Researcher:Worth tracking whether the SharePoint zero-days and the FortiSandbox pair share a common actor or toolkit, or if this is coincidental timing — CISA bundling unrelated urgent patches in the same week says more about exploitation tempo than about the vendors.