[Verse 1] SharePoint's holding documents, terabytes of trust Microsoft's collaboration, but the architecture's thrust Has a fracture in the scaffold — deserialization Untrusted data slipping through without authorization CVE-2026-58644, remember every digit An attacker on the network doesn't need a way in — they're already in it The server reads corrupted data like a genuine command Executes the payload, and the damage spreads unplanned [Chorus — Italian] Pericolo nell'ombra, il codice tradisce Il sistema non capisce cosa il nemico costruisce Ascolta bene, le vulnerabilità non dormono mai Aggiorna, proteggi — o pagherai [Verse 2] Fortinet FortiSandbox — built to cage suspicious code A fortress scanning malware on a quarantined road But CVE-2026-25089 punched a corridor straight through Unauthenticated strangers sending commands the system knew No password, no handshake, just a crafted HTTP thread Injection through the syntax, operating system misled Commands run unauthorized while the sandbox sits oblivious The irony is mordant — the quarantine is imperious [Chorus — Italian] Pericolo nell'ombra, il codice tradisce Il sistema non capisce cosa il nemico costruisce Ascolta bene, le vulnerabilità non dormono mai Aggiorna, proteggi — o pagherai [Verse 3] Twin vulnerabilities, same product, different scar CVE-2026-39808 arrived from not too far Also FortiSandbox, also injection through HTTP Crafted requests whispering to the kernel — "execute for me" The word for this is *nefarious* — meaning wickedly ingenious harm Engineered deception wrapped in ordinary packets, calm Two separate entry vectors in the same security tool An unauthenticated attacker playing the network like a spool [Bridge] Deserialization — when a server trusts what it receives OS injection — when a command line believes Patch SharePoint first, then FortiSandbox closes next These three CVEs are your July twenty-first pretext *Tenebrous* networks — shadowy, obscured from admin sight Lurking in the logs where visibility stays tight Update your defenses while the threat is catalogued and named Vulnerabilities announced are vulnerabilities claimed [Chorus — Italian] Pericolo nell'ombra, il codice tradisce Il sistema non capisce cosa il nemico costruisce Ascolta bene, le vulnerabilità non dormono mai Aggiorna, proteggi — o pagherai [Outro] 58644 — deserialize with caution 25089 — command injection, Boston 39808 — the sandbox gets corroded Three CVEs, July twenty-one — systems overloaded Patch the fracture, seal the corridor, illuminate the tenebrous Before the unauthenticated caller makes your network treacherous
← Canada Gazette — July 21, 2026 | Critical CVEs (2 of 3) — July 21, 2026 →