CISA Sets July 19 Deadline for SharePoint Flaw as Identity Attacks Overtake Exploits

CISA has added CVE-2026-58644, a critical deserialization vulnerability in Microsoft SharePoint Server carrying a 9.8 CVSS score, to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to apply fixes by July 19, 2026. Microsoft warns the flaw is remotely exploitable over the internet with low attack complexity, meaning an attacker authenticated as at least a Site Owner can write and execute arbitrary code remotely. The deadline lands the same week Dark Reading reported that identity attacks have officially overtaken exploits as the top ransomware cause, and as Ernst & Young began notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its own IT personnel.

Why the SharePoint Flaw Deserves Urgent Attention

CVE-2026-58644’s specific characteristics, low attack complexity, no requirement for significant prior system knowledge, and the ability to achieve repeatable successful exploitation, make it a genuinely high-priority target for CISA’s mandatory federal patching deadline. This SharePoint vulnerability adds to the growing list of critical SharePoint and related collaboration infrastructure flaws covered throughout 2026, including the CVE-2026-56164 elevation-of-privilege flaw disclosed just weeks earlier, reinforcing that SharePoint Server specifically has become a persistently attractive target for attackers given how centrally these platforms sit within organizational document and workflow infrastructure.

• The vulnerability requires only Site Owner-level authentication — a considerably lower privilege bar than many critical remote code execution flaws require, meaning a broader population of potentially compromised accounts could enable exploitation
• Repeatable exploitation success increases attacker efficiency — Microsoft’s specific warning about repeatable successful exploitation suggests this flaw is genuinely reliable for attackers to weaponize at scale, rather than requiring precise, difficult-to-replicate conditions
• The July 19 federal deadline signals genuine urgency beyond typical patch cycles — CISA’s compressed timeline reflects the agency’s own assessment that this vulnerability carries meaningfully elevated, time-sensitive risk relative to routine vulnerability disclosures

Identity Attacks Now Officially Lead as the Top Ransomware Cause

Dark Reading’s reporting that identity attacks have overtaken traditional exploits as the leading cause of ransomware incidents formally confirms a pattern already visible throughout 2026’s ransomware coverage, from the ShinyHunters Salesforce OAuth trust abuse to the Silent Ransom Group’s compressed sub-hour vishing attacks. This shift carries genuinely significant implications for how organizations should prioritize security investment, since defenses historically built around patching software vulnerabilities and detecting malware signatures increasingly need to be complemented, or in some cases superseded, by identity-focused security measures like conditional access policies, credential monitoring, and multi-factor authentication hardening specifically resistant to social engineering bypass.

Ernst & Young Discloses a Third-Party Support Ticket Breach

Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its own IT personnel, extending the persistent pattern of supply chain and third-party vendor compromises already covered extensively throughout 2026, including Adobe’s breach through a compromised BPO support vendor. Support ticket systems represent a genuinely underappreciated attack surface, since these platforms frequently contain sensitive troubleshooting details, credentials shared during support interactions, and internal system information that can provide attackers considerable insight into an organization’s broader technical environment.

Bruce Schneier Warns Restricting Frontier AI Access Won’t Contain Its Capabilities

Technologist Bruce Schneier has argued that AI models capable of finding, exploiting, and patching vulnerabilities cannot be effectively contained simply by restricting access to frontier systems, since local models, sophisticated attack harnesses, and corporate incentives will continue shaping cybersecurity’s next phase regardless of frontier model access restrictions. This perspective adds a genuinely important, skeptical counterpoint to the broader frontier model governance conversation already covered extensively throughout 2026, suggesting that access restrictions on the most capable models may prove considerably less effective at containing AI-driven security risk than policymakers and AI labs currently assume.

Healthcare’s Biggest Endpoint Risks Have Genuinely Shifted

Security experts note that lost and stolen unencrypted devices, once a major driver of healthcare’s biggest breaches, have nearly disappeared thanks to encryption, cloud adoption, and stronger asset management, but the biggest endpoint risks have genuinely shifted toward identity, AI, and connected devices instead. This finding reinforces the same identity-attack-dominance pattern already covered in the broader ransomware trend, applied specifically to healthcare’s unique endpoint risk profile, and reflects genuine progress on one historical risk category even as new, arguably more difficult-to-defend risk categories have emerged to take its place.

What Organizations Should Do Now

Organizations running on-premises SharePoint Server should apply the CVE-2026-58644 patch before the July 19 deadline regardless of whether they fall under CISA’s federal mandate, given the vulnerability’s low attack complexity and repeatable exploitation risk. Security teams should treat identity attacks’ confirmed status as the top ransomware cause as justification for reallocating security investment toward identity-focused defenses, including conditional access policies and social-engineering-resistant MFA, rather than continuing to prioritize traditional exploit-focused patching alone. And any organization using third-party support ticket systems, whether for IT operations or customer service, should specifically audit what sensitive information these platforms retain and how thoroughly that access is secured, given Ernst & Young’s confirmed breach through exactly this vector.

This week’s cybersecurity landscape confirms a genuine structural shift already building throughout 2026: identity-based attacks have formally overtaken traditional software exploits as ransomware’s leading cause, even as critical infrastructure vulnerabilities like the new SharePoint flaw continue demanding urgent, parallel attention. Defenders increasingly need to excel at both fronts simultaneously, not choose between them.

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous