Executive Summary: CISA's Three-Pronged Emergency Response
CISA just dropped three binding operational directives in rapid succession, and the pattern is clear: attackers aren't waiting for organizations to patch—they're already inside. SharePoint Server, Oracle E-Business Suite, and Zimbra Collaboration are all being actively exploited right now, and the agency is ordering federal agencies to act within days, not months.
The urgency here isn't theoretical. We're talking about authentication bypasses, remote code execution, and zero-click email exfiltration by a Russian state-sponsored group. Shadowserver has tracked nearly 10,000 exposed SharePoint servers, over 1,000 exposed Oracle EBS instances, and hundreds of Zimbra servers still running vulnerable versions. The numbers don't lie, and neither do the exploit chains.
This is artificial intelligence-driven cybersecurity threats in their most aggressive form: automated scanning, rapid weaponization, and persistent access. If you're running any of these platforms on-premises and haven't patched, you're not just at risk—you're already in the crosshairs.
Source: CISA SharePoint Advisory | Source: CISA Oracle EBS Directive | Source: CISA Zimbra Advisory
SharePoint Server: The Authentication Bypass Chain
Three vulnerabilities are being weaponized against on-premises SharePoint Server instances, and they form a brutal chain: bypass authentication, execute remote code, steal the IIS machine key, and maintain persistence. All supported self-hosted SharePoint Server versions are affected, including the SharePoint Server Subscription Edition.
CVE-2026-32201 is the opener—an authentication bypass in SharePoint's request handling that requires no credentials. Microsoft patched it in July 2026, but CISA added it to the Known Exploited Vulnerabilities list back in April, giving attackers three months of open season.
CVE-2026-45659 is the payload. Once attackers get past authentication, this flaw lets them execute arbitrary code on the server. Think PowerShell scripts, webshells, backdoors. It's been weaponized since July 1.
Then there's CVE-2026-56164—the silent killer. This flaw lets attackers steal the IIS machine key, which encrypts session cookies, view state, and authentication tickets across the entire SharePoint farm. Steal that key, and you can impersonate any user, any admin, any service account. CISA added this to the KEV list on July 14, and federal agencies have until July 17, 2026, to patch it under BOD 26-04 or shut down the affected servers entirely.
CISA also flagged two additional vulnerabilities (CVE-2026-55040 and CVE-2026-58644) that Microsoft patched but aren't yet known to be exploited in the wild. Don't assume they're safe—CISA tagged them as "attractive targets."
Shadowserver currently tracks nearly 10,000 internet-exposed SharePoint servers, with over 800 still unpatched against CVE-2026-32201 and CVE-2026-45659. Since November 2021, CISA has flagged 11 Microsoft SharePoint vulnerabilities exploited in attacks, with 7 of them used in ransomware campaigns. That's a pattern, not a coincidence.
For context on how Microsoft is accelerating its patch cadence to keep pace with these threats, see our analysis of Artificial Intelligence AI Cybersecurity: Navigating Microsoft's Accelerated Patch Cycle.
Source: BleepingComputer - SharePoint
Oracle E-Business Suite: Unauthenticated Financial Takeover
CISA has ordered federal agencies to patch a critical vulnerability in Oracle E-Business Suite by Saturday, July 18, 2026—under the same BOD 26-04 directive. This isn't a suggestion. It's a mandate.
The flaw, CVE-2026-46817, lives in the File Transmission component of Oracle Payments and carries a CVSS score of 9.8. It allows unauthenticated attackers with HTTP network access to take over vulnerable systems in what Oracle calls "low-complexity attacks." In other words, you don't need to be a security expert to exploit this—you just need HTTP access.
Oracle released security updates in its May 2026 Critical Patch Update, warning that "attackers have been successful because targeted customers had failed to apply available Oracle patches." Defused Security confirmed on June 29 that malicious actors were already exploiting it in the wild, observing exploitation on Oracle EBS honeypots over the weekend. No public proof-of-concept code exists, which makes it even more dangerous.
Shadowserver now tracks over 1,000 internet-exposed Oracle EBS instances, with more than half located in the United States. CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities list and ordered agencies to patch or discontinue the affected systems.
Over the last several years, CISA has flagged 43 security vulnerabilities across Oracle products as actively exploited, with 12 linked to ransomware. The trend is clear: Oracle products are increasingly targeted, and the window between disclosure and exploitation keeps shrinking.
Source: BleepingComputer - Oracle EBS
Zimbra Collaboration: Zero-Click Email Espionage by Laundry Bear
Russian state-sponsored group Laundry Bear (also known as Void Blizzard, tracked by Microsoft) is exploiting a zero-click cross-site scripting vulnerability in Zimbra Collaboration Suite to steal organization emails and bypass multi-factor authentication. The flaw, CVE-2025-66376, affects Zimbra's Classic UI and allows JavaScript embedded in malicious HTML emails to execute automatically when a victim views the message—no link clicking required.
CISA says Laundry Bear exploited the flaw as a zero-day before Zimbra patched it in November 2025 and continues targeting organizations running unpatched servers. The group has targeted organizations across the Defense Industrial Base, federal and local government, education, energy, law enforcement, media, and technology sectors.
Here's what makes this campaign particularly nasty: the attackers automatically collect and exfiltrate the victim's last 90 days of emails, email address, password, Global Address List, and two-factor authentication tokens. They then generate a new Zimbra application passcode, which legacy email clients like IMAP or ActiveSync use for authentication—bypassing TOTP-based MFA entirely.
Smaller data payloads are transmitted via DNS A-record queries, while larger mailbox exports go over HTTPS as compressed archives to attacker-controlled servers running the group's "Flowerbed" collection framework. The campaign also uses adversary-in-the-middle phishing kits impersonating legitimate Zimbra login portals, stealing credentials and session cookies.
CISA released indicators of compromise showing domains like 'mailnalysis.com', 'emailanalytics.com.ua', 'zimbrastat.com', 'zimbra-metadata.com', 'istc-cloud.com', and 'zmailanalytics.com' being used to impersonate Zimbra infrastructure. Organizations should update to the latest Zimbra version, review IOCs, investigate systems for connections to identified domains, monitor for suspicious authentication, and revoke any unauthorized application passcodes, especially those with 'ZimbraWeb'.
For a deeper dive into this specific campaign's tactics and indicators, see our coverage of Artificial Intelligence AI Cybersecurity Defenses Face Zero-Click Espionage in Zimbra Exploitation Campaign.
Source: BleepingComputer - Zimbra
Hardening Recommendations: Beyond Patching
Patching is the first step. It's not the last. If you've patched the CVEs but haven't done the other work, you're still vulnerable. Attackers aren't just after the initial exploit—they're after persistence, lateral movement, and data exfiltration.
For SharePoint Server: enable Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications, use Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise, hunt for intrusion artifacts before rotating IIS machine keys, establish tailored logging to monitor for anomalous activity, avoid direct internet exposure of SharePoint servers unless absolutely necessary, and block external access to SharePoint Central Administration. Where exposure is required, place servers behind a Layer 7 reverse proxy or similar application-layer security control. Review Microsoft's official SharePoint Server security-hardening guidance—it's not optional.
For Oracle EBS: apply the May 2026 Critical Patch Update immediately. If you haven't, patch now. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay.
For Zimbra: update to the latest version, review published IOCs, investigate systems for connections to identified domains and IP addresses, monitor for suspicious authentication activity, revoke any unauthorized application passcodes (especially those with 'ZimbraWeb'), review accounts for unauthorized mailbox access, and implement phishing-resistant multi-factor authentication where possible.
The hard truth? If you're still relying on default configurations, you're already compromised. Default settings are for labs, not production. Patching stops the initial breach, but assuming compromise and hunting for artifacts is what keeps you safe. Because if attackers are already inside—and they probably are—patching alone won't save you.
As autonomous systems become more prevalent in enterprise environments, understanding AI Cybersecurity Governance: Why Agentic AI Demands a New Foundation becomes essential for securing these critical infrastructure platforms.
