ThreatScope by DIAMATIX

SharePoint, FortiSandbox, Oracle EBS and KNX Risks (July 15–21, 2026)

Reporting period: July 15–21, 2026
Threat level: High

🎧 Listen to this week’s ThreatScope (audio brief)

This week’s ThreatScope covers five vulnerabilities added to the CISA Known Exploited Vulnerabilities catalogue, together with active campaigns affecting enterprise applications, security appliances, software supply chains and operational technology.

The most urgent issues affect on-premises Microsoft SharePoint, FortiSandbox, Oracle E-Business Suite Payments and KNX-based building automation environments.

The operational priority is not determined by CVSS alone. Active exploitation, internet exposure, the role of the affected system and the potential impact on business operations should determine the order of response.

Patching remains necessary, but it should not be treated as proof that the risk has been resolved. Security teams should confirm exposure, review affected systems for evidence of compromise and validate that remediation has been completed successfully.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organization operates any of the following technologies or environments.

If none of these technologies are present in your environment, the vulnerabilities covered this week may not require immediate remediation. However, the observed campaigns involving malicious software packages and fake installers may still be relevant to development teams, endpoint security operations and users with access to privileged systems.

Executive Summary

CISA added five vulnerabilities with confirmed real-world exploitation during the reporting period.

The highest immediate risk comes from:

• unauthenticated remote code execution in on-premises Microsoft SharePoint;
• two operating system command injection vulnerabilities in FortiSandbox;
• unauthenticated compromise of Oracle E-Business Suite Payments;
• disruption and lockout risks affecting KNX building automation devices.

The SharePoint issue requires more than patching. Post-exploitation activity may include theft of IIS machine keys, persistence through deserialization mechanisms and deployment of malware.

The FortiSandbox vulnerabilities are especially significant because the affected product is itself part of the security stack. Compromise of a security appliance may allow attackers to alter its configuration, create accounts, run commands or use the system as a trusted point inside the network.

The Oracle E-Business Suite vulnerability may affect financial workflows and sensitive business data. Systems exposed through HTTP or accessible from untrusted networks should receive immediate attention.

The KNX issue carries a different type of risk. It may allow devices to be cleared or locked, creating prolonged disruption in building management or operational technology environments.

This week’s campaigns also include compromised AsyncAPI npm packages associated with Miasma RAT, fake Zoom, WebEx and MobaXterm installers delivering Starland RAT, and operational technology risks involving Siemens RUGGEDCOM ROX II.

Key Vulnerabilities

Two vulnerabilities from the previous reporting period should remain in the same emergency remediation and hunting cycle:

• CVE-2026-56164 affecting SharePoint and associated with active exploitation;
• CVE-2026-56155 affecting Active Directory Federation Services and allowing privilege escalation.

Vulnerability Analysis

Microsoft SharePoint Server — CVE-2026-58644

CVE-2026-58644 affects on-premises Microsoft SharePoint Server 2016, 2019 and Subscription Edition.

The vulnerability allows unauthenticated remote code execution. Where the server is accessible from the internet, exploitation may occur without valid credentials.

The risk does not end when the security update is installed. Observed post-exploitation activity includes theft of IIS machine keys, use of deserialization mechanisms for persistence and deployment of malware.

Stolen machine keys may allow attackers to retain access or abuse trusted application functions even after the original vulnerability has been patched. For this reason, key rotation should follow compromise assessment and removal of malicious artefacts. Rotating keys before cleaning the environment may interrupt investigation without eliminating attacker access.

Most Relevant For

• large organizations running on-premises Microsoft environments;
• government and public administration;
• healthcare and education;
• finance and regulated enterprises;
• organizations with externally accessible collaboration platforms.

How to Verify Exposure

Confirm the following:

• Does the organization operate SharePoint Server 2016, 2019 or Subscription Edition?
• Is the SharePoint instance accessible from the internet or from third-party networks?
• Is the currently installed build covered by the latest Microsoft security update?
• Is Antimalware Scan Interface protection enabled for every SharePoint web application?
• Have IIS, SharePoint and endpoint detection logs been reviewed for suspicious activity?
• Have unexpected files, processes, scheduled tasks or web artefacts been identified?
• Has the organization reviewed whether IIS machine keys may have been exposed?

Required Response

Patch affected systems immediately.

Where patching cannot be completed, remove external access or isolate the system until remediation is possible.

Validate Antimalware Scan Interface coverage, review Microsoft Defender or endpoint detection and response detections, inspect IIS and web logs, remove malicious artefacts and rotate machine keys only after the environment has been cleaned.

Oracle E-Business Suite Payments — CVE-2026-46817

CVE-2026-46817 affects Oracle E-Business Suite Payments versions 12.2.3 through 12.2.15.

The vulnerability may allow an unauthenticated attacker to compromise the application through HTTP. Because the affected component supports payment and financial functions, successful exploitation may affect transactions, privileged workflows, sensitive data and audit integrity.

The actual business impact depends on how the application is deployed, which functions are enabled and whether the service is accessible from external or untrusted networks.

Most Relevant For

• large enterprises using Oracle E-Business Suite;
• finance and payment operations;
• manufacturing and supply-chain organizations;
• retail, transport and logistics;
• organizations with integrated financial and enterprise resource planning workflows.

How to Verify Exposure

Confirm the following:

• Is Oracle E-Business Suite Payments deployed?
• Does the installed version fall between 12.2.3 and 12.2.15?
• Is the affected service accessible through HTTP?
• Is external or partner access allowed?
• Has the latest Oracle Critical Patch Update been applied?
• Have web and application logs been reviewed for unusual requests?
• Have privileged transactions, administrative changes and new accounts been checked?
• Are financial workflows monitored for unexpected changes?

Required Response

Apply the relevant Oracle Critical Patch Update.

Restrict HTTP and external access where possible. Review web and application logs, privileged transactions, administrative activity and changes to payment-related configurations.

Where exposure is confirmed, treat the activity as a potential business-system compromise rather than a routine patching task.

FortiSandbox — CVE-2026-25089

CVE-2026-25089 affects FortiSandbox, FortiSandbox Cloud and platform-as-a-service deployments.

The vulnerability allows unauthenticated operating system command injection through crafted HTTP requests.

The affected product is designed to analyse suspicious files and support security operations. It may therefore process untrusted content, connect to multiple systems and hold privileged configuration data.

Compromise of the appliance may allow an attacker to run commands, create accounts, alter configuration, establish outbound communication or use the product as a trusted point inside the environment.

Most Relevant For

• enterprises using Fortinet security infrastructure;
• managed service providers and managed security service providers;
• financial services;
• critical infrastructure;
• organizations with centrally managed security appliances.

How to Verify Exposure

Confirm the following:

• Which FortiSandbox deployment model is in use?
• Which version is currently installed?
• Is the graphical management interface externally accessible?
• Can the system be reached from user, guest or third-party networks?
• Are there new or unexplained administrator accounts?
• Have unusual commands, processes or scheduled tasks been identified?
• Are there unexpected outbound connections or command-and-control indicators?
• Has the appliance configuration been compared with an approved baseline?

Required Response

Upgrade to version 5.0.6 or later, or 4.4.9 or later where applicable.

Restrict access to the graphical management interface, inspect commands and account activity and review outbound network connections.

If suspicious activity is found, isolate the appliance and validate connected systems that may have trusted or administrative relationships with it.

FortiSandbox API — CVE-2026-39808

CVE-2026-39808 affects FortiSandbox versions 4.4.0 through 4.4.8.

The vulnerability enables operating system command injection through the application programming interface. Successful exploitation may provide full control of the appliance.

The main difference from the previous FortiSandbox issue is the affected interface and version scope. In practical terms, both vulnerabilities require immediate version validation, access restriction and integrity review.

Most Relevant For

• organizations using FortiSandbox 4.4;
• security operations centres;
• managed security providers;
• regulated organizations with central security infrastructure.

How to Verify Exposure

Confirm the following:

• Is the installed version between 4.4.0 and 4.4.8?
• Is the application programming interface enabled?
• Which networks, accounts and systems can access it?
• Are API calls logged and reviewed?
• Have configuration files, accounts and system integrity been validated?
• Are there unexplained outbound connections or changes to the appliance?

Required Response

Upgrade to version 4.4.9 or later.

Restrict management and application programming interface access, review authentication and API logs and compare the appliance configuration with a known approved state.

Do not assume that a security appliance is trustworthy only because it remains operational.

KNX Connection Authorization — CVE-2023-4346

CVE-2023-4346 affects KNX Connection Authorization Option 1.

Successful exploitation may allow an attacker to clear or lock devices. The result may be prolonged disruption to building management or operational technology functions and, in some cases, loss of recoverable access.

The severity score is lower than those assigned to the remote code execution vulnerabilities in this report, but the operational consequences may still be significant.

A locked or cleared building automation device may affect environmental controls, access management, lighting, facility operations or other connected functions.

Most Relevant For

• hospitals and healthcare facilities;
• hotels and large commercial buildings;
• manufacturing sites;
• public facilities;
• organizations operating building management or smart-building systems.

How to Verify Exposure

Confirm the following:

• Does the organization use KNX-based building automation?
• Is Connection Authorization Option 1 enabled?
• Are KNX devices inventoried?
• Are management interfaces reachable from corporate, guest or external networks?
• Is the building management system segmented from general information technology networks?
• Are current device configurations backed up?
• Has restoration been tested?
• Are vendor mitigations available for the deployed devices?

Required Response

Segment KNX and building management environments.

Block untrusted access paths, restrict management interfaces and apply available vendor mitigations.

Validate backups of device configurations and test the restoration process. For systems supporting critical facilities, recovery should be treated as an operational resilience requirement rather than only a cybersecurity control.

Active Campaigns and Tactics

SharePoint Exploitation

CISA reporting describes both remote code execution and post-exploitation activity involving theft of IIS machine keys, deserialization-based persistence and malware deployment.

The correct response sequence is:

1. confirm exposure;
2. patch or isolate;
3. enable and validate Antimalware Scan Interface protection;
4. conduct threat hunting;
5. remove malicious artefacts;
6. rotate machine keys and other exposed secrets;
7. validate that the environment is clean.

A patch without post-compromise validation may leave persistence mechanisms or stolen credentials unaddressed.

AsyncAPI and Miasma-Train-P1

Compromised release pipelines were used to publish five trojanized npm packages associated with Miasma RAT.

The risk extends beyond direct users of the affected packages. Malicious code may pass through developer endpoints, package caches, continuous integration and continuous delivery systems and downstream build artefacts.

Development teams should not focus only on installed packages. They should also examine lockfiles, software bills of materials, cached dependencies, build histories and tokens used by release pipelines.

UAT-11795 and Starland RAT

A financially motivated campaign targeting organizations in the United States and Europe used fake Zoom, WebEx and MobaXterm installers together with ClickFix techniques.

The activity delivered Starland RAT and an in-memory WLDR agent.

The campaign demonstrates the operational risk associated with unofficial software downloads and user-executed command sequences. Application allowlisting, controlled software distribution and endpoint telemetry remain important controls.

Operational Technology Watchlist

A vulnerability chain affecting Siemens RUGGEDCOM ROX II, involving CVE-2025-40947, CVE-2025-40948 and CVE-2025-40949, may allow persistent root access.

Version 2.17.1 is recommended where applicable.

HelloNet also demonstrates the risk of persistence through compromised update components. Organizations operating industrial environments should validate both device versions and the integrity of update mechanisms.

What Deserves Attention This Week?

Enterprise Information Technology

Priority systems:

• Microsoft SharePoint;
• Oracle E-Business Suite;
• Active Directory Federation Services;
• FortiSandbox.

Primary actions:

• validate versions and external exposure;
• patch or isolate;
• review privileged activity;
• hunt for post-exploitation artefacts;
• rotate secrets only after remediation.

Operational Technology and Building Management

Priority systems:

• KNX building automation;
• Siemens RUGGEDCOM ROX II;
• connected building management devices.

Primary actions:

• confirm asset inventory;
• validate network segmentation;
• restrict management access;
• back up configurations;
• test restoration procedures.

Development and Software Delivery

Priority areas:

• AsyncAPI packages;
• npm dependencies;
• release pipelines;
• developer endpoints;
• continuous integration and continuous delivery tokens.

Primary actions:

• block affected package versions;
• review lockfiles and software bills of materials;
• inspect caches and build artefacts;
• rotate exposed pipeline credentials;
• apply package allowlisting and approval controls.

Endpoint and User Security

Priority activity:

• fake Zoom, WebEx and MobaXterm installers;
• ClickFix techniques;
• in-memory malware execution.

Primary actions:

• distribute software only through approved channels;
• review endpoint detections and script execution;
• restrict unapproved tools;
• investigate unusual command-line activity.

Recommended Management Actions

Immediate Actions (0–7 Days)

• Identify whether Microsoft SharePoint, FortiSandbox, Oracle E-Business Suite or KNX technologies are present in the environment.
• Validate installed versions and determine whether affected systems are internet-facing.
• Apply available security updates or temporarily isolate exposed systems where patching is not immediately possible.
• Conduct compromise assessment for systems with confirmed active exploitation before rotating credentials, machine keys or certificates.
• Block affected AsyncAPI npm package versions and review development environments for indicators of compromise.
• Initiate incident response procedures where successful exploitation cannot be ruled out.

Actions Within 30 Days

• Review administrative accounts, privileged activity and authentication logs across affected systems.
• Validate network segmentation for operational technology (OT) and building management environments.
• Confirm that backup and recovery procedures have been successfully tested for critical platforms.
• Strengthen controls for software supply chain security, including dependency management and CI/CD pipeline protection.
• Close or formally document any remediation exceptions that remain open.

Strategic Actions (Within 90 Days)

• Improve visibility of internet-facing assets through continuous attack surface management.
• Integrate software supply chain security into vulnerability management and change management processes.
• Establish regular validation of backup, restoration and operational resilience procedures.
• Review remediation performance metrics and unresolved risks at the management level.
• Incorporate lessons learned from active exploitation into future risk assessments and security planning.

Enterprise Exposure Assessment

Security teams should prioritize systems based on four factors:

1. Active Exploitation

A vulnerability listed in the CISA Known Exploited Vulnerabilities catalogue has already moved beyond theoretical risk.

This should increase its priority even when the numerical severity score is lower than that of other vulnerabilities.

2. External Accessibility

Internet-facing systems remain the most immediate concern.

This includes not only public applications, but also management interfaces, APIs, partner portals and systems exposed through remote-access services.

3. Business Role

The same vulnerability may have different consequences depending on the system.

Compromise of SharePoint may affect internal documents and identities. Compromise of Oracle E-Business Suite may affect financial operations. Compromise of KNX may affect facilities and physical operations.

4. Recovery Readiness

Organizations should confirm whether they can restore the affected system safely.

For building automation and operational technology, configuration backups and tested restoration procedures may be as important as patch deployment.

Ongoing Security Controls

Beyond the immediate remediation cycle, security teams should:

• maintain an accurate inventory of internet-facing and business-critical systems;
• map technologies to system owners and dependent business services;
• validate remediation through version checks, vulnerability scanning and configuration review;
• monitor administrative interfaces, privileged accounts and trust relationships;
• conduct threat hunting when active exploitation or confirmed exposure is identified;
• test recovery procedures for operational technology and building management systems;
• control package sources, dependencies and software delivery workflows;
• report unresolved remediation exceptions and accepted risks to management.

Questions for Leadership

Boards and executive teams should ask:

1. Do we operate any of the affected technologies?
2. Which affected systems are accessible from the internet?
3. Have the required updates been installed and independently verified?
4. Has threat hunting been completed for systems associated with active exploitation?
5. Do we have evidence that affected systems have not been compromised?
6. Have exposed credentials, keys or certificates been rotated after cleanup?
7. Are KNX and operational technology environments segmented from corporate networks?
8. Can critical building or industrial systems be restored from validated backups?
9. Are software packages and developer dependencies controlled through an approved process?
10. Which remediation exceptions remain open, and who has accepted the risk?

ISO 27001 Alignment

The actions in this report support several areas of an Information Security Management System under ISO/IEC 27001, including:

• asset inventory and ownership;
• vulnerability and patch management;
• secure configuration;
• logging and monitoring;
• access control;
• supplier and software supply-chain security;
• incident response;
• network segregation;
• backup and recovery;
• business continuity;
• risk treatment and management review.

Evidence should be retained for each action. A statement that an update was deployed is not sufficient on its own. Organizations should preserve version records, scan results, hunting outcomes, access reviews and recovery-test evidence.

ISO 9001 Alignment

The same response activities also support quality management principles under ISO 9001 by requiring:

• defined ownership;
• controlled change processes;
• documented evidence;
• corrective action;
• validation of outcomes;
• management review;
• continual improvement.

The purpose is not only to perform remediation, but to demonstrate that the process produced the intended result.

Need Help Assessing Your Exposure?

If your organization uses any of the technologies covered in this report, identifying them is only the first step.

The next step is understanding:

• whether security updates have been successfully deployed;
• whether management interfaces remain exposed to the internet;
• whether there are indicators of attempted or successful exploitation;
• which systems should be prioritized based on operational impact.

DIAMATIX helps organizations assess exposure, validate remediation and strengthen continuous monitoring through expert-led security operations.

Contact our team to discuss your environment.

Conclusion

The vulnerabilities covered this week affect systems with very different roles: collaboration platforms, financial applications, security appliances and building automation. They should not be treated as a single uniform patching list. Organizations should first confirm which technologies are present, where they are exposed and which business processes depend on them. From there, response should follow the operational priority of each system.

For SharePoint, FortiSandbox and Oracle E-Business Suite, immediate patching or isolation should be combined with compromise assessment.

For KNX and other operational technology systems, segmentation, configuration backup and tested recovery are central to reducing operational impact.

For development teams, the AsyncAPI campaign requires package, token and build-pipeline review.

The objective is to establish, with evidence, that exposure has been reduced, compromise has been investigated and critical services can continue operating safely.

Sources

1. ThreatScope Weekly Research
2. CISA — Known Exploited Vulnerabilities additions, July 15, 2026
3. CISA — Known Exploited Vulnerabilities additions, July 16, 2026
4. CISA — Microsoft SharePoint hardening guidance
5. Microsoft Security Response Center — CVE-2026-58644
6. Oracle — May 2026 Critical Patch Update Risk Matrix
7. Fortinet — FG-IR-26-141 and FG-IR-26-100
8. Unit 42 — AsyncAPI npm supply-chain campaign
9. Cisco Talos — UAT-11795 campaign analysis
10. Siemens ProductCERT — SSA-078743
11. Kaspersky — HelloNet campaign analysis

Methodology and limitation: This report is based on open-source intelligence and vulnerability intelligence, prioritizing confirmed exploitation, vendor advisories, external exposure and business criticality. Applicability must be validated against the organization’s actual asset inventory, deployed versions and configurations. The report does not, by itself, confirm the presence or absence of compromise.

Trusted · Innovative · Vigilant