Friday, July 17, 2026
Daily digest
Two stories demand immediate action today: a CVSS 9.8 SharePoint RCE zero-day is being actively exploited with a Federal patch deadline of July 19, and a publicly released Windows LegacyHive zero-day enables privilege escalation on fully patched systems with no patch available yet.
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
CISA added CVE-2026-58644, a critical (CVSS 9.8) deserialization remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog. Active exploitation has been confirmed. Federal Civilian Executive Branch agencies are required to apply the patch by July 19, 2026.
Why it matters: If you run any on-premises SharePoint Server instances — including hybrid configurations integrated with M365 GCC High — patch immediately; the July 19 federal deadline is effectively today. Confirm whether your environment uses SharePoint Server or is fully cloud-side SharePoint Online (Online is not affected).
New Windows LegacyHive Zero-Day Gives Attackers Admin Privileges
A security researcher publicly released a working exploit called LegacyHive that achieves local privilege escalation on fully up-to-date Windows systems. No patch is currently available. The exploit has been disclosed without a coordinated vendor response.
Why it matters: Your Intune-managed Windows 11 fleet is exposed with no patch option right now. Prioritize compensating controls: ensure standard users don't have local admin rights, audit privileged account usage, and watch for MSRC guidance. This is a realistic post-exploitation escalation path if any endpoint is compromised.
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
Microsoft Defender Experts documented a surge in ACR Stealer activity from late April through mid-June 2026, delivered via ClickFix social engineering that tricks users into pasting commands into a Run dialog. The stealer exfiltrates saved browser credentials, live session tokens, PDFs, and Microsoft 365 documents including files from synced OneDrive and SharePoint folders. Two distinct intrusion chains were identified.
Why it matters: This directly targets M365 document stores and session tokens — your GCC High environment's most sensitive data paths. Review Defender for Endpoint alerts for ClickFix-related command execution (RunMRU / PowerShell via Run dialog), and confirm Attack Surface Reduction rules blocking untrusted process execution are enforced in Intune.
CISA Urges Immediate Action on Actively Exploited Fortinet FortiSandbox Flaws
CISA added two actively exploited vulnerabilities in Fortinet's FortiSandbox threat detection platform to its KEV catalog and ordered government agencies to patch by a Sunday deadline. Both flaws are being exploited in the wild. Details on CVE numbers and CVSS scores were not fully specified in the snippet but the agency treated them as high-priority.
Why it matters: If FortiSandbox is part of your network security stack or your prime/subcontractor chain, treat Sunday's deadline as binding. Even outside the FCEB mandate, KEV-listed actively exploited vulnerabilities are the highest-priority patch class under NIST 800-171-adjacent risk management.
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
Elastic Security Labs documented TELEPUZ, a new modular malware spreading since late April 2026 via ClickFix-infected websites. The malware is described as lightweight, full-featured, and capable of data theft and remote command execution, communicating with a small but active set of C2 domains.
Why it matters: Combined with ACR Stealer above, this confirms ClickFix as an active, high-volume delivery mechanism right now. If you haven't blocked the ClickFix attack vector via ASR rules or user awareness campaigns, two separate active malware families are exploiting the same gap simultaneously.
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
A vulnerability in n8n's Enterprise edition allows authentication bypass on instances configured with multiple external JWT token issuers. The platform matched incoming tokens on the 'sub' claim alone while ignoring the 'iss' (issuer) field, allowing a valid token from one issuer to authenticate as a different user registered under another issuer. No password is required.
Why it matters: If n8n is part of your Ansible or automation pipeline with SSO/JWT integration against multiple identity providers, verify your version and patch status immediately. In a CMMC L2 environment, an authentication bypass in an automation platform with access to infrastructure APIs is a critical lateral movement risk.
1M+ Emails Use Hidden Text to Dupe AI Security Filters
Researchers identified a campaign of over one million phishing emails using 'text salting' — inserting invisible or hidden characters — to evade AI-based email security filters. The technique exploits how LLM-based detectors process text, allowing malicious emails to pass through as benign.
Why it matters: If your GCC High email security posture relies on AI/ML-based filtering (including Defender for Office 365), this is a known active bypass at scale. Verify that traditional rule-based and reputation controls are layered alongside AI detection — don't treat AI filtering as a standalone control.
Windows Server 2022 Reaches End of Mainstream Support in 90 Days
Microsoft confirmed Windows Server 2022 will exit mainstream support in October 2026, transitioning to extended support through 2031. Security updates will continue during extended support, but new feature requests and non-security hotfixes will no longer be accepted under mainstream terms.
Why it matters: For CMMC L2 audit purposes, document that Server 2022 remains on a vendor-supported, actively patched OS branch through 2031 — this transition does not create a compliance gap. However, now is the time to update your system security plan (SSP) language and asset inventory to reflect the support tier change.
NTP Server That Traveled Back in Time Caused Massive Australian Mobile Outage
Telstra suffered a major mobile network outage traced to an NTP server that drifted backward in time after a missed patch was applied incorrectly. The carrier had no change record for the modification and no monitoring in place to detect the time anomaly before it cascaded into a network-wide failure.
Why it matters: NTP integrity is a frequently overlooked dependency in Kerberos authentication, TLS certificate validation, and audit log integrity — all of which are NIST 800-171 relevant controls. Verify your NTP hierarchy is monitored, patched, and change-controlled, particularly for Nutanix AHV hosts and AWS GovCloud instances where clock skew can break authentication silently.
Post-Quantum Cryptography: A Strategic Imperative for Modernization
A Federal News Network commentary piece outlines the urgency of migrating federal systems to post-quantum cryptographic standards, citing NIST's finalized PQC algorithms and forthcoming mandates for federal contractors. The piece argues organizations should begin cryptographic inventory and migration planning now rather than waiting for hard deadlines.
Why it matters: DoD is expected to incorporate PQC requirements into future CMMC and DFARS updates. If your M365 GCC High, AWS GovCloud, or VPN infrastructure relies on RSA or ECC key exchange, a cryptographic inventory is a reasonable near-term action to avoid scrambling when contractual mandates arrive.
Cyber Agencies Warn Critical Industries About Russia-Linked Hackers Targeting Routers
U.S. and allied cyber agencies issued a warning that Russia-linked threat actors have spent years quietly extracting configuration data from poorly configured routers across critical infrastructure sectors. The advisory highlights persistent, low-and-slow reconnaissance activity targeting network devices rather than endpoints.
Why it matters: Router configuration data exfiltration is a direct NIST 800-171 concern under configuration management (3.4.x) and system communications protection (3.13.x). Audit your edge router and firewall configurations for default credentials, exposed management interfaces, and SNMP community strings.
AWS CloudFront Outage Serves Errors Instead of Websites
An AWS CloudFront outage disrupted multiple downstream services, with the cause traced to storm-related infrastructure impact. Services including Hugging Face and the UK National Lottery were knocked offline. The incident was resolved but exposed single-point-of-failure risks in CloudFront-dependent architectures.
Why it matters: If any AWS GovCloud workloads or externally facing services route through CloudFront distributions, this is a reminder to validate your continuity documentation and contingency plan (NIST 800-171 3.6.x) covers CDN-layer failures, not just compute or storage outages.