Act now:SharePoint: Four July-August 2026 Flaws Now Exploited. Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, above all farms reachable from the internet or allowing anonymous access.
Patch this week:AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs. Organizations running AD FS on Windows Server 2012 through 2025, especially farms first built on Server 2012 or 2012 R2 and any farm that has not yet installed the October 13, 2026 update.
Check exposure:AsyncAPI npm Packages Backdoored via pull_request_target. Anyone whose lockfile, cache or CI run picked up @asyncapi/specs 6.11.2 or 6.11.2-alpha.1, @asyncapi/generator 3.3.1, generator-helpers 1.1.1 or generator-components 0.7.1 on or after July 14, 2026, including via transitive dependencies.
Do you run any of these? Microsoft SharePoint Server, Microsoft Active Directory Federation Services, SonicWall SMA1000 Appliances. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-17.
npm: 2 critical advisories (n8n-mcp, tidgi). Check with npm audit (or: npm ls <package>).
Composer (PHP): 2 critical advisories (facturascripts/facturascripts). Check with composer audit.
Go: 1 critical advisory (github.com/julien040/anyquery). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
If you run an SMA1000 appliance, install the September hotfix and check it for compromise today; the July fix alone does not cover the second pair of exploited bugs.
Must act: Anyone operating SonicWall SMA1000 (6210, 7210, 8200v) appliances on 12.4.3-03453 / 12.5.0-02835 or older, physical or virtual.
Can relax: SonicWall firewall SSL-VPN and SMA 100 series users, which SonicWall says are not affected, and organizations with no SMA1000 in their estate.
Check every SMA1000's firmware build; anything at or below 12.4.3-03453 or 12.5.0-02835 is exposed to the September pair.
Install platform-hotfix 12.4.3-03526 or 12.5.0-02952 (or later) from mysonicwall.com.
Review the appliance for the July indicators below and open a SonicWall support case to check for September indicators.
Any on-premises SharePoint farm not yet on the August 2026 builds is exposed to exploited bugs with public exploit code; patch, rotate machine keys and check for compromise now.
Must act: Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, above all farms reachable from the internet or allowing anonymous access.
Can relax: SharePoint Online (Microsoft 365) customers, who are not listed as affected, and on-prem farms that were on the August 2026 builds by mid-August and are not internet-facing.
Check each farm's build with (Get-SPFarm).BuildVersion and compare it with the August 2026 builds.
Install every August 2026 SharePoint package Microsoft lists for your version, then run PSConfig on each server.
Rotate ASP.NET machine keys (Update-SPMachineKey) and run iisreset after patching.
A single unauthenticated request turns an unpatched Switchvox PBX into a shell; if yours is below 8.4.0.2 and reachable from the internet, upgrade today and check it for compromise.
Must act: Anyone running an on-premises Sangoma Switchvox phone system below 8.4.0.2, most urgently where its web interface is reachable from the internet.
Can relax: Switchvox systems already on 8.4.0.2 (released July 14, 2026) or later, and organizations not running Switchvox; FreePBX is a separate Sangoma product with its own advisories.
Check the Switchvox version in the admin interface and upgrade anything below 8.4.0.2 to 8.4.0.2 or later.
Remove internet exposure of the Switchvox web interface; allow only phone VLANs, trusted admin networks or a VPN to reach it.
If you cannot upgrade immediately, block external access to the /pa path at your firewall or reverse proxy.
Ignore the modest vendor score: this was exploited as a zero-day against on-prem SharePoint, so internet-facing farms need the July 2026 updates, a machine-key rotation and a compromise check now.
Must act: Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, especially farms published to the internet.
Can relax: SharePoint Online (Microsoft 365) customers are not affected and have nothing to patch.
Install the July 2026 SharePoint security update on every server in the farm (Windows cumulative updates alone do not fix SharePoint)
Confirm the earlier CVE-2026-45659 update is also in place (it is included in the July builds)
Rotate ASP.NET/IIS machine keys after patching and restart IIS
If you run AD FS, install the October 2026 or later Windows update on every farm server this week and confirm the DKM container ACL was fixed; unless you opted in, the July patch only flagged the weak permissions.
Must act: Organizations running AD FS on Windows Server 2012 through 2025, especially farms first built on Server 2012 or 2012 R2 and any farm that has not yet installed the October 13, 2026 update.
Can relax: Organizations with no AD FS servers, such as cloud-only Microsoft Entra ID tenants; other Windows machines just need routine patching.
Identify every AD FS server (Get-WindowsFeature ADFS-Federation) and record its OS build.
Install the October 13, 2026 or later cumulative update on every farm member; it remediates insecure DKM container ACLs by default.
Check the AD FS/Admin log for events 1132, 1133, 1135, 1136 and 1137, and fix any remediation failure using KB5121391.
If any build resolved @asyncapi/specs 6.11.2 or the July 14 generator releases, treat that machine as backdoored; everyone else should still fix their own pull_request_target workflows.
Must act: Anyone whose lockfile, cache or CI run picked up @asyncapi/specs 6.11.2 or 6.11.2-alpha.1, @asyncapi/generator 3.3.1, generator-helpers 1.1.1 or generator-components 0.7.1 on or after July 14, 2026, including via transitive dependencies.
Can relax: Projects whose lockfiles stayed on @asyncapi/specs 6.11.1 and generator 3.3.0 or earlier through July 14-15; the bad versions have since been removed from npm.
Search lockfiles, artifact mirrors and CI caches for the five malicious versions, including transitive @asyncapi/specs pulls.
Pin @asyncapi/specs to 6.11.1 (or a later clean release) and purge npm/Yarn caches on shared runners.
On hosts that imported a bad version, kill detached node processes, delete the NodeJS/sync.js drop and persistence, then reimage if possible.