Five Patches You Need to Deploy This Week

 CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalogue in the last ten days of June and the first days of July. Each one is being exploited in the wild right now. Two carry CVSS 10.0 scores. One has a 98.9% EPSS probability. 

Here is what you need to know and what you need to do. 

CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE 

CVSS: 8.8

CISA added this on July 1. The due date for federal agencies was July 4. That gave agencies three days to respond.

The vulnerability is a deserialization of untrusted data flaw in SharePoint Server using authenticated remote code execution. An attacker with site member permissions can execute code remotely on the SharePoint server. Site member is the lowest privileged role that can interact with SharePoint content. Every user with a SharePoint license has it. 

Microsoft patched this in May 2026 for SharePoint Server Subscription Edition, Server 2019, and Enterprise Server 2016. If you have not deployed that patch, you are vulnerable to a known-exploited RCE that CISA has flagged as an operational priority. 

The exploitation details are not public, which usually means one of two things: it is being used in targeted operations that the victims have not disclosed, or it is being used in automated campaigns that have not been attributed. Neither scenario is comforting. 

Action: Patch SharePoint Server. Check your patch status against the May 2026 Microsoft Update. If you cannot patch immediately, restrict access to SharePoint Server to trusted IP ranges and enforce MFA on all SharePoint interactions. CVE-2026-45659 is not the first SharePoint KEV this year. CVE-2026-32201 was added earlier in 2026. Attackers are working through the SharePoint attack surface systematically. 

CVE-2026-48558: SimpleHelp OIDC Authentication Bypass 

CVSS: 10.0

This authentication bypass vulnerability affects SimpleHelp remote monitoring and management software versions 5.5.15 and prior and 6.0 pre-release builds. CISA added it on June 29 with a three-day remediation deadline. 

The vulnerability: SimpleHelp accepts unsigned tokens during OIDC authentication. An attacker can forge a token and authenticate as any user, including an administrator. No credentials required. 

This is a critical concern for managed service providers. SimpleHelp is used for remote access to client environments. A compromise of the SimpleHelp server gives the attacker access to every client environment connected to it. CISA explicitly warned about MSP supply chain risk in the advisory. 

Threat actors are deploying the TaskWeaver loader through this vulnerability. This is not theoretical. CISA confirmed active exploitation. 

Action: Update SimpleHelp to version 5.5.16 or later. If you are a managed service provider, treat this as a supply chain incident. Assume that if your SimpleHelp server was exposed, client environments may be compromised. Contact every client and rotate credentials. 

CVE-2026-10520: Ivanti Sentry OS Command Injection 

CVSS: 10.0

This is a pre-authentication OS command injection in Ivanti Sentry (formerly MobileIron Sentry). It was added to KEV on June 11 with an EPSS probability of 98.9%. 

This is not a difficult exploitation. A remote, unauthenticated attacker can execute arbitrary commands on the Ivanti Sentry server with no authentication required. Ivanti Sentry is deployed at the network edge, often in DMZ configurations, managing mobile device management traffic. A Sentry compromise can lead to lateral movement into internal MDM infrastructure and from there to every managed device. 

Action: If you run Ivanti Sentry, it is likely already compromised or being probed. The 98.9% EPSS score means this is being actively exploited at scale. Patch immediately. Audit the Sentry server for signs of compromise. Check for unauthorized processes, outbound connections, and credential access. 

CVE-2026-35273: Oracle PeopleSoft People Tools 

CVSS: 9.8

This unauthenticated remote code execution was added to KEV on June 12 with an EPSS probability of 92.3%. 

This affects PeopleSoft People Tools versions 8.61 and 8.62. Oracle released a patch in its June 2026 Critical Patch Update. CISA added it to KEV within days, confirming active exploitation. 

PeopleSoft handles HR, payroll, and financial data at most organisations that run it. A People Tools compromise is not a low-impact event. The attacker can access employee PII, payroll data, and financial records. 

Action: Apply the Oracle Critical Patch Update for June 2026. If PeopleSoft is externally-facing, restrict access to trusted IP ranges immediately. Audit PeopleSoft logs for unusual access patterns. 

The Full List from the Last 30 Days

Beyond the four above, the following are also in active exploitation and worth attention.

What the KEV Catalogue Is Telling Us 

The consistent pattern across this wave of KEV additions is unauthenticated or low-privilege access leading to full system compromise. Every vulnerability on this list gives the attacker a foothold from which lateral movement is straightforward. 

The time-to-exploit window continues to shrink. Fortinet’s Global Threat Landscape Report documented a time-to-exploit of 24-48 hours for critical vulnerabilities. The gap between patch release and exploitation is measured in hours, not weeks. 

Organizations that take longer than a week to patch critical CVEs are operating with a known gap that attackers are actively exploiting. CISA KEV inclusion is not a warning. It is a confirmation that exploitation is happening right now. 

If you run any of the affected products, assume your environment has been scanned for these vulnerabilities. Patch this week or risk an incident.