NOTABLECVE-2026-2699 +1exploitedupdateNATOA2vulnerability

Correction — the two Progress ShareFile Storage Zone Controller flaws in this pipeline's W29 round-up were never added to the CISA KEV catalogue, so its 'every one KEV-listed' claim was wrong when written

discovered 2026-08-09 14:18 UTCrun 2026-08-09T1315Z-audit1 sourcesingle-source

UPDATE · originally covered Internet-facing enterprise software moved from 'at risk' to 'under attack' across the week — SonicWall SMA1000, Progress ShareFile, Oracle E-Business Suite and on-prem SharePoint all crossed into confirmed exploitation (2026-07-19)

the delta is a single clause in that entry's summary, and it is one a reader could have acted on.

The entry described four classes of internet-facing enterprise software crossing into confirmed in-the-wild exploitation during ISO week 29, "every one KEV-listed". Eight of the ten identifiers involved bear that out. The SonicWall SMA1000 pair was added on 2026-07-14, Oracle E-Business Suite Payments on 2026-07-15, the AD FS and SharePoint elevation-of-privilege flaws on 2026-07-14, the wider SharePoint remote-code-execution flaw on 2026-07-16, and the two further SharePoint identifiers the entry quoted from CISA's own alert on 2026-04-14 and 2026-07-01 — all before the entry was published. The two Progress ShareFile Storage Zone Controller identifiers, CVE-2026-2699 and CVE-2026-2701, are not in the catalogue and never have been. Because CISA does not remove entries once added, their absence today is not a later withdrawal; the claim did not hold on 2026-07-19 either.

The exploitation claim underneath it is unaffected, and the distinction is the point. The original entry's own sourcing for ShareFile was Shadowserver honeypot telemetry — "first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday", the same day Progress ordered every on-premises Storage Zone Controller powered off (BankInfoSecurity, 2026-07-13). That evidence stood on its own and still does. What the round-up added, and should not have, was a second and independent-looking confirmation from a catalogue that never carried these identifiers. This pipeline's per-CVE coverage made no KEV claim about either identifier at any point — the error entered only in the weekly synthesis, where ten identifiers from four stories were summarised in one clause.

Defender takeaway

for a defender the practical consequence is narrow but real, because KEV listing and vendor-reported exploitation are different signals with different follow-through. A team that filters its out-of-band work queue on KEV membership — a common and defensible way to bound emergency patching — would have searched for these two identifiers, found nothing, and concluded the round-up had confused them or that the entries had been withdrawn. The correct reading is that ShareFile warranted the same out-of-band response as the rest of that week's set on the strength of observed exploitation and an emergency vendor shutdown instruction, with no catalogue entry to confirm it. Where an aggregate claim covers several stories at once, the weakest member governs what the sentence may assert.

Honeypots run by nonprofit cybersecurity organization Shadowserver Foundation first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday.

BankInfoSecurity 2026-07-13

ATT&CK mapping

1 technique mapped from the cited reporting · MITRE ATT&CK v19.2

Initial Access TA0001

T1190Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

overlap matrix · ATT&CK page ↗

Sources

BankInfoSecurityprimary

Update chain

updates Internet-facing enterprise software moved from 'at risk' to 'under attack' across the week — SonicWall SMA1000, Progress ShareFile, Oracle E-Business Suite and on-prem SharePoint all crossed into confirmed exploitation 2026-07-19

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Assessment

NATOA2NATO Admiralty code

Source reliabilityA Completely reliable

Info credibility2 Probably true

Verificationsingle-source

Confidencehigh

The corrected fact — the absence of both identifiers from the CISA KEV catalogue — is established mechanically rather than editorially: this run fetched the catalogue through the repository's bridge fetcher and read the identifier list directly (catalogVersion 2026.08.07, dateReleased 2026-08-07T16:45:47Z, 1662 entries). The catalogue itself is a dashboard artefact rather than a citable article, so it is named by version here instead of linked. The single cited source is the reporting the original entry relied on for the exploitation claim, which this correction leaves standing. No CVSS is carried in this record because the correction concerns catalogue status only and restating scores from the earlier entry without re-deriving them from the owning authority would reintroduce exactly the kind of second-hand transcription this pipeline treats as a defect.

CVEs

CVE-2026-2699

exploited

CVE-2026-2701

exploited

ATT&CK techniques

T1190 Exploit Public-Facing Application

Affected products

Progress ShareFile Storage Zone Controller

Tags · regions · sectors

vulnerabilities actively-exploited auth-bypass pre-auth global europepublic-sectortechnologyfinance