CISA’s July 2026 KEV additions put SharePoint, Fortinet, Oracle, SonicWall and CMS/plugin exposure back on the small-business patch-priority list. Here is what to check first.