Enterprise security teams are closing out one of the busiest patch windows of the year. Two actively exploited flaws in core business platforms — Microsoft SharePoint Server and Oracle E-Business Suite — headline a July in which ransomware operators demonstrated dramatically compressed attack timelines.
SharePoint: CVSS 9.8, and a federal deadline
CISA added a critical Microsoft SharePoint Server vulnerability (CVE-2026-58644, CVSS 9.8) to its Known Exploited Vulnerabilities catalog, giving U.S. federal agencies a remediation deadline of July 19, 2026 — one of the tighter turnarounds the agency has issued this year (The Hacker News). A KEV listing means exploitation is confirmed in the wild: private-sector teams running on-premises SharePoint should treat the federal deadline as their own.
Oracle E-Business Suite: ERP under direct attack
Oracle E-Business Suite is affected by a critical remote code execution flaw reportedly exploited against roughly 950 internet-exposed instances worldwide. Successful exploitation hands attackers control of the ERP system itself — the software that runs finance, procurement and HR (SecurityWeek). ERP compromise is a business-continuity event, not just a security incident: the immediate mitigation is removing internet exposure while patching.
Ransomware is getting faster
Threat intelligence reporting this month tracked a new ransomware actor, Spirals, completing a full corporate intrusion — initial access to data theft and encryption — in under 24 hours (Check Point Research). Researchers also flagged the GodDamn ransomware family, which uses the PoisonX kernel driver to neutralize endpoint security software before encryption.
The real-world impact is visible in the consumer economy: Coca-Cola disclosed that a ransomware attack on its Fairlife dairy subsidiary disrupted operations and temporarily suspended production across the United States (TechCrunch). Meanwhile, the Conduent breach has grown into one of the year’s largest, with healthcare breach reporting placing the affected population at more than 62.2 million individuals.
What security leaders should do this week
- Patch SharePoint and Oracle EBS first. Both are confirmed exploited; both sit at the heart of business operations.
- Audit internet exposure of ERP and collaboration platforms. The ~950 exposed EBS instances were findable by anyone with a scanner.
- Plan for a sub-24-hour adversary. If your detection-to-containment loop assumes days, the Spirals timeline breaks it. Tabletop against a one-shift intrusion.
- Test kernel-level defenses. Driver-abuse techniques like PoisonX bypass tools that only watch user space.
More from Silicon Media Network: our latest technology coverage, including how the Fortune 500 are deploying agentic AI.