This brief covers cyber security developments from the trailing ~48 hours (July 30 – August 1, 2026). Every item below was verified against its primary source — vendor advisory, government alert, or original research — before inclusion.

CosmosEscape: Wiz researchers could have taken over every Azure Cosmos DB database

Wiz Research · July 30, 2026

Wiz Research disclosed CosmosEscape, a critical vulnerability chain in Azure Cosmos DB’s Gremlin API. By escaping the Gremlin query sandbox via .NET reflection, researchers gained code execution on the multi-tenant DB Gateway and extracted a platform-wide signing secret they dubbed the “Cosmos Master Key” — capable of retrieving the primary key of any Cosmos DB account across all tenants, regions, and API flavors. No CVE ID or CVSS score was assigned to this cloud-service flaw. Microsoft deployed a hotfix within 48 hours of the November 2025 report, completed a permanent architectural fix across all regions in July 2026, and found no evidence of exploitation or customer data access. No customer action is required.

“It was a platform-wide key that could retrieve the primary key for any Cosmos DB account on the service, all through publicly accessible endpoints.” — Wiz Research

Source: Wiz Research blog · SecurityWeek

CISA urges water utilities to pull exposed PLCs offline after coordinated attacks on 30+ Minnesota systems

CISA · July 30, 2026

CISA issued an alert warning of a significant increase in threat activity targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. The alert follows a coordinated cyberattack on more than 30 Minnesota community water systems that state officials suspect may be linked to Iran; attackers changed PLC passwords to lock out operators, modified IP addresses to disconnect devices, and disrupted operations, forcing some utilities to switch to manual operation. CISA specifically flagged undocumented cellular modems as a common blind spot and pointed Rockwell Automation MicroLogix 1400 owners to vendor recovery guidance. Censys estimates more than 4,100 Rockwell/Allen-Bradley hosts, 4,100 Siemens hosts, and over 2,000 Schneider Electric hosts are currently reachable from the public internet.

“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.” — CISA alert, July 30, 2026

Source: CISA alert · BleepingComputer

Sophos: Microsoft Teams vishing campaign STAC4749 deployed Chaos ransomware in under 17 hours

Sophos · July 30, 2026

Sophos detailed STAC4749, a Teams voice-phishing campaign that targeted dozens of North American organizations between February and June 2026 — roughly 95% in Canada (50%) and the U.S. (44%). Operators posed as IT helpdesk staff from “.top” domains like info-secure[.]top, talked victims into Quick Assist or RemSupp remote sessions, then deployed a custom loader, a Python backdoor, and Golang C2 implants with pinned certificates. At least three intrusions ended in Chaos ransomware deployment; in one case, initial access to encryption took less than 17 hours. Most scam calls lasted just two to two-and-a-half minutes.

“Given the short interval between initial access and encryption, Sophos analysts assess with high confidence that STAC4749 was a financially motivated operation that either directly deployed ransomware or coordinated with affiliates.” — Sophos

Source: Sophos threat research · BleepingComputer

Still developing

Cisco patches actively exploited Secure FMC zero-day CVE-2026-20316; KEV deadline was August 1

Cisco / CISA · July 29, 2026

Cisco released patches for CVE-2026-20316, a static-credential vulnerability in Secure Firewall Management Center that lets a remote, unauthenticated attacker log into devices using default credentials for a low-privilege account and access sensitive data. Cisco rates it high severity, confirmed active exploitation observed in July, and published indicators of compromise; the flaw can be chained with other FMC bugs to escalate privileges. CISA added it to the Known Exploited Vulnerabilities catalog on July 29 with a remediation deadline of August 1 for federal agencies. Discovery is credited to a Horizon3.ai researcher.

“If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.” — Cisco security advisory

Source: Cisco advisory · CISA KEV alert · SecurityWeek

Russian group TA488 exploits Exchange OWA flaw CVE-2026-42897 to plant OWAReaper implant

Proofpoint · July 29, 2026

Proofpoint reported that Russia-aligned TA488 (Void Blizzard / Laundry Bear) began a campaign on July 22 exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access that Microsoft patched in June 2026, against US and European government entities plus telecom, financial, hospitality, and aerospace targets. Opening a crafted email is enough to execute OWAReaper, a browser-resident JavaScript implant that steals autofill credentials and OAuth tokens, grants mailbox-wide folder permissions to the tenant’s “Default” user, and persists in OWA settings and the offline message cache. Campaign infrastructure dates to March 2026 — two months before Microsoft’s out-of-band patch — suggesting possible zero-day use.

“This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user’s device will not evict the actor.” — Proofpoint Threat Research

Source: Proofpoint threat research · NVD entry · BleepingComputer

This brief covers the trailing ~48 hours (July 30 – August 1, 2026). Primary sources: Wiz Research, CISA Alert (Jul 30), Sophos, Cisco PSIRT, CISA KEV (Jul 29), Proofpoint.

This brief covers the trailing ~48 hours (July 24–26, 2026). Every item below was checked against its primary advisory, vendor PSIRT, original research write-up, or the CISA KEV catalog, and the disclosure or publication date was confirmed to fall within (or, for the “Still developing” section, just outside) the window.

Researchers publish working GitLab RCE chain from two five-year-old Oj memory-corruption bugs

depthfirst · July 24, 2026

depthfirst detailed — and released proof-of-concept code for — a remote code execution chain against default self-managed GitLab, built by combining two memory-safety flaws in Oj, the native-C Ruby JSON parser used by GitLab’s Jupyter notebook diff renderer. An authenticated user who can push to a project commits a crafted .ipynb file and opens its commit diff, driving repository-controlled bytes into Oj inside a Puma worker; an out-of-bounds write plus a heap-pointer disclosure are chained to hijack a callback pointer and reach system(), executing commands as the git account. The chain affects GitLab CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1 (fixed in 18.10.8, 18.11.5, and 19.0.2 by upgrading to Oj 3.17.3, shipped June 10). GitLab did not file the underlying fix as a security fix, so there is no CVE or CVSS for the chain itself; the broader Oj review produced nine published advisories including CVE-2026-54502, CVE-2026-54896, and CVE-2026-54903. No in-the-wild exploitation was reported at publication.

“A normal authenticated user who could push to a project and view its commit diff could reach this path from their own project. Exploitation required no administrator privileges, CI or runner access, victim interaction, or access to another user’s project.” — Yuhang Wu, depthfirst

Source: depthfirst research · GitLab 19.0.2 patch release · The Hacker News

“Certighost” exploit lets a low-privileged AD user impersonate a Domain Controller (CVE-2026-54121)

Microsoft MSRC / independent researchers · July 24, 2026

Researchers H0j3n and Aniq Fakhrul published a working exploit for an Active Directory Certificate Services flaw they codenamed Certighost, tracked as CVE-2026-54121 (CVSS 8.8, improper authorization), which Microsoft patched on July 14. The bug lives in the AD CS enrollment “chase” fallback: an Enterprise CA follows a requester-supplied Domain Controller host over SMB and LDAP without first proving it is a real DC, letting a normal domain account obtain a certificate for a Domain Controller and authenticate as that machine via PKINIT. Because DC accounts carry directory-replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync. Exploitation needs only network access and a domain account (no admin rights, no user interaction), and the full PoC is public. The flaw was not on CISA’s KEV catalog as of July 24, and no primary source reviewed reported in-the-wild exploitation.

“As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild, but the full proof-of-concept was public. That absence of reporting does not prove that exploitation has not occurred.” — The Hacker News

Source: Microsoft MSRC advisory · NVD · The Hacker News

Fastjson 1.x RCE (CVE-2026-16723) reported under active attack with no 1.x patch available

Alibaba advisory / ThreatBook / Imperva · advisory July 21, exploitation reported July 22–25, 2026

Alibaba published an advisory for CVE-2026-16723 (Alibaba-assigned CVSS 9.0), a critical RCE in the Fastjson 1.x Java JSON library affecting versions 1.2.68 through 1.2.83. In a Spring Boot executable fat-JAR application, an attacker-controlled @type value can be turned into a class-resource lookup that fetches attacker-controlled bytecode, yielding unauthenticated code execution with the privileges of the Java process; the maintainers confirmed the chain requires no AutoType enablement and no classpath gadget. ThreatBook reported capturing in-the-wild exploitation on July 22, and Imperva reported activity against U.S. financial-services, healthcare, and retail organizations. As of July 25 no fixed Fastjson 1.x artifact was available — mitigations are enabling SafeMode (-Dfastjson.parser.safeMode=true) or using the 1.2.83_noneautotype build, with migration to Fastjson2 as the long-term fix. Note: a July 23 CISA-ADP assessment marked exploitation as “none,” and the flaw was absent from CISA’s KEV catalog on July 25.

“As of July 25, Alibaba had not released a fixed Fastjson 1.x version.” — The Hacker News

Source: Alibaba advisory · NVD · The Hacker News

Still developing

Cl0p-linked actors chain unauthenticated RCE against internet-exposed PTC Windchill / FlexPLM (CVE-2026-12569)

Ransom-ISAC / PTC · July 25, 2026

A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED describes a data-extortion campaign, with tradecraft attributed to Cl0p (aka FIN11 / Graceful Spider / Lace Tempest), against internet-exposed PTC Windchill and FlexPLM. Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) with a server-side flaw in the Windchill login servlet, CVE-2026-12569 (CVSS 9.3), which CISA added to its KEV catalog in late June. Successful exploitation yields unauthenticated RCE and hex-named JSP web shells under /Windchill/login/, followed by staging and double-extortion theft of engineering and design data across manufacturing, automotive, aerospace, and retail targets.

“Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling unauthenticated remote code execution and deployment of hex-named JSP web shells under /Windchill/login/.” — Ransom-ISAC / eCrime.ch / DEFUSED advisory

Source: Ransom-ISAC advisory · The Hacker News

This brief covers the trailing ~48 hours (July 24–26, 2026).

Primary sources:

• depthfirst — GitLab RCE via two Ruby memory-corruption vulnerabilities
• GitLab — June 10 patch release (19.0.2 / 18.11.5 / 18.10.8)
• Microsoft MSRC — CVE-2026-54121
• NVD — CVE-2026-54121
• Alibaba — Fastjson 1.x RCE advisory (CVE-2026-16723)
• NVD — CVE-2026-16723
• Ransom-ISAC — Cl0p Windchill/FlexPLM exploitation advisory
• CISA — Known Exploited Vulnerabilities Catalog

This brief covers the trailing ~48 hours (July 16–18, 2026). Every item below was verified against its primary source — vendor advisory, researcher writeup, or CISA KEV entry — before inclusion.

wp2shell: pre-authentication RCE in WordPress core, emergency releases 6.9.5 and 7.0.2 pushed as forced updates

Searchlight Cyber / WordPress.org · July 17, 2026

Searchlight Cyber’s Assetnote research team (Adam Kues) disclosed wp2shell, a pre-authentication remote code execution flaw in WordPress core that chains a REST API batch-route confusion with SQL injection — a default install with zero plugins is exploitable by an anonymous HTTP request. Affected versions are 6.9.0–6.9.4 and 7.0.0–7.0.1; WordPress shipped 6.9.5 and 7.0.2 on July 17 and enabled forced automatic updates, while 6.8.6 backports a fix for the SQL injection component on the 6.8 branch. No CVE ID or CVSS score had been assigned at publication, technical details are being withheld, and no in-the-wild exploitation had been reported as of July 18. If you cannot update immediately, block both /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or disable anonymous REST access.

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” — Searchlight Cyber security advisory

Source: Searchlight Cyber advisory · WordPress 7.0.2 release post · The Hacker News

CISA adds two actively exploited Fortinet FortiSandbox command injection flaws to KEV

CISA · July 16, 2026

CISA added CVE-2026-25089 (CVSS 9.8) and CVE-2026-39808, both OS command injection vulnerabilities in Fortinet FortiSandbox, to the Known Exploited Vulnerabilities catalog on evidence of active exploitation. CVE-2026-25089 allows a remote, unauthenticated attacker to execute arbitrary commands via specially crafted HTTP requests. Fortinet published fixes in its June advisories, so patches are available; federal agencies are on a short remediation clock under BOD 22-01.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA, KEV catalog alert

Source: CISA alert · SecurityWeek

SharePoint deserialization RCE CVE-2026-58644 lands in KEV two days after Patch Tuesday

CISA / Microsoft · July 16, 2026

CVE-2026-58644 (CVSS 9.8), a critical deserialization-of-untrusted-data vulnerability in Microsoft SharePoint Server that allows an unauthorized attacker to execute arbitrary code, was added to the KEV catalog in the same July 16 update. Microsoft patched it in the July 14 Patch Tuesday release and had initially flagged it only as an attractive target with no known exploitation — the KEV addition confirms exploitation evidence emerged within roughly 48 hours of the patch. Federal agencies have until July 19 to remediate. This lands on top of an already rough month for on-prem SharePoint: CISA is separately tracking active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, with Shadowserver counting roughly 10,000 internet-exposed SharePoint servers.

Source: CISA alert · BleepingComputer

Still developing

SonicWall SMA1000 zero-days under active exploitation — SonicWall / Rapid7 · July 14, 2026. SonicWall confirmed two zero-days in SMA1000-series secure remote-access appliances: CVE-2026-15409 (CVSS 10.0), an SSRF in the Work Place interface, and CVE-2026-15410 (CVSS 7.2), a post-authentication code injection in the Appliance Management Console. Rapid7 has observed targeted zero-day exploitation of internet-facing appliances since at least late June. Patches are available. Source: BleepingComputer · The Hacker News

Microsoft’s record July Patch Tuesday: 570+ fixes, two exploited zero-days — Microsoft · July 14, 2026. The July update fixed CVE-2026-56155, an actively exploited AD FS elevation-of-privilege flaw, and CVE-2026-56164, an actively exploited SharePoint Server elevation-of-privilege flaw that CISA added to KEV the same day with a July 17 federal deadline. Source: BleepingComputer · CISA alert

LegacyHive Windows zero-day PoC published, no patch available — July 15, 2026. A researcher going by “Nightmare Eclipse” released a proof-of-concept exploit abusing the Windows User Profile Service for local privilege escalation to admin-level access, hours after Patch Tuesday. It affects supported Windows desktop and Server versions including fully patched systems, and has no CVE ID yet. Source: BleepingComputer

This brief covers the trailing ~48 hours (July 16–18, 2026).
Primary sources: Searchlight Cyber — wp2shell advisory · WordPress.org — 7.0.2 release · CISA — July 16 KEV additions · CISA — July 14 KEV additions · CISA KEV catalog

This brief covers cyber security developments from the trailing ~48 hours (July 14–16, 2026). Every item below was verified against its primary source — vendor advisory, CISA KEV entry, or original researcher publication — and dated within the window.

Microsoft’s record 570-flaw Patch Tuesday fixes two actively exploited zero-days in AD FS and SharePoint

Microsoft MSRC / Zero Day Initiative · July 14, 2026

Microsoft’s July 2026 Patch Tuesday shipped fixes for a record 570 vulnerabilities, including 59 rated Critical and two zero-days under active exploitation: CVE-2026-56155 (CVSS 7.8), an elevation-of-privilege flaw in Active Directory Federation Services stemming from insufficient access-control granularity, and CVE-2026-56164 (CVSS 5.3), an unauthenticated, network-reachable elevation-of-privilege bug in Microsoft SharePoint Server credited to Mandiant and Google Cloud researchers. Both were added to CISA’s KEV catalog on July 14, and CISA issued a companion alert urging SharePoint hardening. A third zero-day, the publicly disclosed BitLocker security-feature bypass CVE-2026-50661 (CVSS 6.1), was also patched but is not known to be exploited.

“It’s a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.” — Trend Micro Zero Day Initiative, on CVE-2026-56164

Source: Microsoft MSRC (CVE-2026-56155) · Microsoft MSRC (CVE-2026-56164) · ZDI July 2026 review · BleepingComputer

SonicWall SMA1000 zero-days exploited in the wild — CVSS 10.0 SSRF plus admin-console code injection

SonicWall PSIRT · July 14, 2026

SonicWall confirmed active zero-day exploitation of two SMA1000 appliance vulnerabilities: CVE-2026-15409 (CVSS 10.0), an unauthenticated server-side request forgery in the Work Place interface, and CVE-2026-15410 (CVSS 7.2), a post-authentication OS command injection in the Appliance Management Console. Affected models 6210, 7210, and 8200v are fixed in platform-hotfix versions 12.4.3-03453 and 12.5.0-02835; SonicWall says there are no workarounds other than patching and published IOCs including rogue /__api__/login routes. CISA added both CVEs to the KEV catalog on July 14 with a federal remediation deadline of July 17.

“SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.” — SonicWall advisory SNWLID-2026-0008

Source: SonicWall PSIRT SNWLID-2026-0008 · CISA KEV alert · BleepingComputer

AsyncAPI npm packages with 3M+ weekly downloads compromised via stolen GitHub Actions token

Datadog Security Labs · July 14, 2026

Four packages in the @asyncapi npm namespace — @asyncapi/generator 3.3.1, generator-components 0.7.1, generator-helpers 1.1.1, and specs 6.11.2/6.11.2-alpha.1 — were published with malicious code after an attacker exploited a misconfigured GitHub Actions workflow to steal a privileged bot personal access token. The implant chains a first-stage downloader to an IPFS-hosted second stage and a modular framework that steals browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets, with command-and-control over HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh. Affected versions have been removed; teams should audit lockfiles and rotate any credentials present on machines that installed them.

“A commit to the AsyncAPI generator GitHub repository injected obfuscated JavaScript into four npm packages with a combined weekly download volume of over 3 million.” — Datadog Security Labs

Source: Datadog Security Labs · The Hacker News

CISA adds actively exploited Oracle E-Business Suite takeover flaw to KEV

CISA · July 15, 2026

CISA added CVE-2026-46817 (CVSS 9.8), an improper privilege management flaw in the Oracle Payments component of Oracle E-Business Suite versions 12.2.3–12.2.15, to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of July 18. The bug allows an unauthenticated attacker with HTTP access to fully take over Oracle Payments; in-the-wild exploitation was observed before any public proof-of-concept existed. Oracle patched the flaw in last month’s Critical Patch Update — organizations should confirm the CPU is applied and check whether EBS instances are internet-exposed. The same KEV update also added CVE-2023-4346, a KNX protocol authorization weakness affecting building-automation deployments.

Source: CISA KEV alert · SecurityWeek · BleepingComputer

Progress confirms zero-day path traversal behind emergency ShareFile Storage Zone shutdown, ships patches

Progress Software · July 14, 2026

Progress confirmed that last week’s emergency shutdown of ShareFile Storage Zone Controllers was driven by a high-severity path traversal vulnerability affecting all 5.x and 6.x versions, disclosed to the company via a “credible external security threat” warning. An authenticated administrator can read arbitrary files accessible to the service account, write attacker-controlled content to arbitrary directories, or enumerate the filesystem. Fixed versions 5.12.5 and 6.0.2 are available now; a reserved CVE will be published in about two weeks. Progress says it has found no evidence of customer compromise.

“Currently, we have no indication of unauthorized access to any ShareFile customer account or data, and we have not identified any active threat.” — Progress Software

Source: Progress ShareFile downloads/advisory · BleepingComputer

This brief covers the trailing ~48 hours (July 14–16, 2026).
Primary sources: CISA KEV alert (July 14) · CISA KEV alert (July 15) · CISA SharePoint hardening alert · Microsoft MSRC · SonicWall PSIRT · Datadog Security Labs · Zero Day Initiative

The headline: 622 vulnerabilities, triple the old record

Microsoft MSRC · July 14, 2026

Microsoft’s July 2026 Patch Tuesday addresses 622 vulnerabilities by the Security Update Guide’s own count — more than triple June’s previous all-time record of roughly 200. The batch includes 416 flaws in Windows (itself a record), 82 in Office, 46 in Edge, 27 in developer tools, and 17 in SharePoint Server. Roughly one in ten — about 60, depending on whose tally you use — are rated Critical, with 48 of those enabling remote code execution. Twenty-six vulnerabilities carry a CVSS base score above 9.0, and 13 sit at 9.8.

“The mother of all releases.” — Dustin Childs, head of threat awareness, Trend Micro Zero Day Initiative

A note on counting: totals vary by methodology. Microsoft’s Security Update Guide says 622; ZDI independently counts 621 (63 Critical); Tenable counts 569 unique CVEs; BleepingComputer counts 570 by excluding fixes shipped earlier in the month and the 468 Edge/Chromium flaws Google patched upstream. By every method, this is the largest Patch Tuesday ever, and the year-to-date CVE count already exceeds every prior full year.

Source: Microsoft Security Update Guide · ZDI July 2026 review, CyberScoop, Dark Reading

Why the explosion? AI found the bugs — and AI will exploit them

Microsoft / industry analysis · July 9–14, 2026

This wasn’t a surprise. On July 9, Windows executive VP Pavan Davuluri warned customers to expect a higher volume of security updates per release as Microsoft applies its multi-model agentic scanning harness (MDASH) across the Windows codebase — the same AI pipeline that independently found 16 significant vulnerabilities in a prior release. Tenable’s Satnam Narang projects Microsoft could exceed 2,000–3,000 CVEs this calendar year, while stressing that the volume reflects how good AI tooling has become at finding bugs, not necessarily how many pose real-world risk.

The same automation cuts the other way: attackers can diff patches against previous builds and produce working exploits within hours, not weeks. Microsoft has correspondingly tightened its deployment guidance, now recommending organizations defer Windows quality updates by no more than three days, with update deadlines of zero or one day. The traditional “wait and soak” patch cycle is effectively dead; several research teams declared today the start of the continuous-patching era.

One structural change worth noting for anyone who tracks these releases: the Security Update Guide no longer enumerates each vulnerability individually. It now presents a summary table of counts by product family plus a slim “Notable CVEs” section — a format change Rapid7 flagged as a real reduction in day-one, product-by-product detail.

Source: SecurityWeek, CyberScoop, Rapid7, PCWorld

The Top 10 patches — what they are and why they matter

Ranked by real-world urgency: exploited zero-days first, then public disclosures, then the highest-impact criticals.

1. CVE-2026-56155 — Active Directory Federation Services elevation of privilege (exploited zero-day)

CVSSv3 7.8 · Important · Exploited in the wild. Insufficient granularity of access control in AD FS lets an authenticated attacker elevate to administrator locally. Discovery is credited to Microsoft’s own DART incident-response team — a strong signal it surfaced during a live intrusion investigation. AD FS signs the authentication tokens the rest of your estate trusts, so a “local” privilege bug on that box is worth far more to an attacker than the label suggests. CISA has added it to the KEV catalog with a federal remediation deadline of July 28. Patch AD FS servers first, and don’t expose them to the internet.

2. CVE-2026-56164 — SharePoint Server elevation of privilege (exploited zero-day)

CVSSv3 5.3 · Exploited in the wild. Missing authentication for a critical function allows an unauthenticated attacker to elevate privileges over the network against SharePoint Server 2016, 2019, and Subscription Edition, with low attack complexity and repeatable success. The modest score is misleading — this is the month’s clearest example of why you can’t sort by CVSS alone. Credits include Mandiant Incident Response and Google Cloud researchers, another indicator of active-incident origins a year after the ToolShell wave hammered on-prem SharePoint. CISA’s KEV deadline for federal agencies is July 17 — three days. Enabling AMSI with Full request-body scanning provides interim mitigation.

3. CVE-2026-50661 — Windows BitLocker security feature bypass (publicly disclosed)

CVSSv3 6.1 · Important · Public before patch. An attacker with physical access can bypass BitLocker Device Encryption and read encrypted data. Microsoft credits “Anonymous,” but researchers widely believe this patches GreatXML, the zero-day dropped by the pseudonymous researcher Nightmare Eclipse (a.k.a. Chaotic Eclipse) the day after June’s Patch Tuesday. It’s the third physical-access BitLocker bypass patched in two months. Exploit code is public, so treat disclosure as a countdown clock: prioritize laptop fleets and traveling hardware, and use TPM+PIN preboot authentication where the data warrants it.

4. CVE-2026-57092 — Windows VMSwitch guest-to-host escape

CVSS 9.9 · Critical. The highest-scored bug of the month: a flaw in the Hyper-V virtual switch that lets an attacker escape a VM boundary and compromise the host. One compromised guest becomes every workload on the hypervisor, which is why virtualization hosts should be patched ahead of the guests they carry. Several related Critical Hyper-V escalations shipped alongside it.

5. CVE-2026-55040 — SharePoint JWT authentication bypass (half of an unauthenticated RCE chain)

CVSS disputed: 5.3 (Rapid7/Microsoft “Important”) vs. 9.1 (ZDI “Critical”). Discovered by Rapid7’s Stephen Fewer for Pwn2Own Berlin, this JWT authentication bypass chains with a second, still-embargoed RCE bug to achieve unauthenticated remote code execution against SharePoint. The RCE half isn’t scheduled for a patch until August — meaning this month’s bypass fix is what breaks the chain. Patch it in the same pass as the SharePoint zero-day above. Also relevant: SharePoint 2016 and 2019 just exited extended support, so Subscription Edition is now the only fully supported self-hosted option.

6. CVE-2026-58644 & CVE-2026-50522 — SharePoint Server deserialization RCE pair

CVSS 9.8 · Critical. Two deserialization-of-untrusted-data flaws allowing unauthenticated remote code execution over the network. Combined with the two entries above, SharePoint accounts for 17 CVEs this month and is unmistakably the product family under the most attacker attention. If you run on-prem SharePoint, today is a drop-everything day.

7. CVE-2026-55944 — Dynamics NAV / Dynamics 365 Business Central RCE

CVSS 9.8 · Critical · “Exploitation More Likely.” A crafted login request triggers deserialization of untrusted data on an affected Dynamics NAV or Business Central server — no authentication, no user interaction. It’s the same bug class as the SharePoint pair but easy to overlook because it lives in the ERP stack rather than the collaboration stack. Finance-adjacent systems make attractive targets; don’t let this one slide to next cycle.

8. CVE-2026-56188 — Windows Server Network driver race condition (wormable)

CVSS 9.8 · Critical · “Exploitation More Likely.” A race condition in the Windows Server Network driver allows an unauthenticated attacker to execute code over the network — the profile that earns the “wormable” label. Unauthenticated, network-reachable, no interaction: this is the class of bug that historically powers self-propagating attacks once an exploit lands.

9. The DHCP cluster — CVE-2026-50518, CVE-2026-50370, CVE-2026-54128 and friends

Up to CVSS 9.8 · five RCEs across DHCP Server and Client. Nine DHCP-related CVEs shipped this month, five rated Critical and three assessed “Exploitation More Likely.” The standouts are heap-based buffer overflows in DHCP Server exploitable over the network (CVE-2026-50518) and an adjacent network (CVE-2026-50370), plus a use-after-free in the DHCP Client (CVE-2026-54128). DHCP is on by default in essentially every Windows environment and rarely thought about — exactly the kind of ambient attack surface a cluster like this turns dangerous.

10. CVE-2026-48561 — Microsoft Copilot remote code execution

CVSS 9.6 · Critical. A command injection flaw lets an unauthenticated attacker execute arbitrary code over the network through Microsoft Copilot. Beyond the score, it’s emblematic of the month’s most important trend: AI-assistant attack surface is now a fixture of every Patch Tuesday, with additional entries this month in GitHub Copilot, Visual Studio/VS Code Copilot integrations, and a vaguely described Outlook Copilot tampering issue.

Honorable mentions

Beyond the top ten: CVE-2026-55008, an Exchange Server spoofing flaw (CVSS 9.6) flagged “more likely” to be exploited; two Microsoft Defender RCEs (CVE-2026-55011, CVE-2026-55012) delivered via engine updates; a trio of 9.8s in Remote Desktop Client (CVE-2026-54990), Windows FTP Service (CVE-2026-49172), and MSMQ (CVE-2026-50447); an unusual 21-bug cluster across NTFS and ReFS filesystem drivers suggesting a shared root cause; and — proof that AI scanning sweeps the whole portfolio — Critical RCEs in Minecraft Bedrock Dedicated Server (CVE-2026-55010) and a code-execution flaw in Age of Empires II: Definitive Edition (CVE-2026-50663). This release also permanently removes the Kerberos RC4 rollback switch (RC4DefaultDisablementPhase), completing Microsoft’s multi-year RC4 deprecation — audit any lingering RC4-dependent service accounts before deploying.

Bottom line

Patch in this order: the two exploited zero-days (AD FS and SharePoint — CISA deadlines are July 17 and July 28 for federal agencies, and those are sane targets for everyone else), then the publicly disclosed BitLocker bypass on mobile hardware, then internet-facing and identity infrastructure, then virtualization hosts, then the 9.8-class network RCEs. Volume is the story of 2026, but triage discipline — KEV first, EPSS and exposure over raw CVSS — is the defense. June’s record lasted exactly one month; there’s no reason to believe July’s will fare better.

Coverage window: July 14, 2026 (Patch Tuesday release day).
Primary sources: Microsoft Security Update Guide · Zero Day Initiative July 2026 review · Tenable · Rapid7 · Cisco Talos · Qualys · Dark Reading · SecurityWeek · CyberScoop

This brief covers the trailing ~48 hours (July 12–14, 2026). Every item below was verified against its primary source — vendor advisories, CISA, and the original researchers — before inclusion.

Microsoft’s record July Patch Tuesday fixes 570 flaws, including two actively exploited zero-days

Microsoft MSRC · July 14, 2026

Microsoft’s July 2026 Patch Tuesday is its largest ever, addressing roughly 570 vulnerabilities (59 rated Critical), including two zero-days exploited in the wild: CVE-2026-56155, an Active Directory Federation Services elevation-of-privilege flaw (CVSSv3 7.8) credited to Microsoft’s DART incident-response team, and CVE-2026-56164, a SharePoint Server elevation-of-privilege flaw (CVSSv3 5.3) affecting SharePoint 2016, 2019, and Subscription Edition, credited in part to Mandiant and Google Cloud researchers. A third zero-day, the publicly disclosed BitLocker bypass CVE-2026-50661, was also patched. All are fixed as of today; none appeared in CISA’s KEV catalog at publication time. Microsoft notes that enabling AMSI with Full request-body scanning mitigates the SharePoint flaw.

“Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.” — Microsoft advisory for CVE-2026-56155

Source: MSRC CVE-2026-56155, MSRC CVE-2026-56164 · BleepingComputer, Tenable

SAP patches CVSS 9.9 NetWeaver ABAP memory corruption on July Patch Day

SAP · July 14, 2026

SAP’s July 2026 Security Patch Day delivers 20 new and updated security notes, led by CVE-2026-44747 (CVSS 9.9), a memory corruption bug in NetWeaver Application Server ABAP that can expose data and cause system unavailability; disabling affected ICF nodes in transaction SICF is a temporary workaround. Also fixed are CVE-2026-27690 (CVSS 9.1), an unauthenticated HTTP request-smuggling flaw in Approuter in non–Cloud Foundry deployments, and CVE-2026-44761 (CVSS 9.1), hardcoded sample OAuth2 credentials in Commerce Cloud that allow unauthenticated data access if sample scripts were retained in production. Patches are available; no exploitation has been reported.

“The vulnerability affects SAP Approuter deployments in non-Cloud Foundry environments and allows an unauthenticated attacker to send a specially crafted HTTP request that leads to request-response desynchronization.” — Onapsis

Source: SAP Security Patch Day – July 2026, Onapsis · SecurityWeek

Jscrambler npm packages backdoored with cross-platform credential stealer

Jscrambler / Socket · July 13–14, 2026

A threat actor used a compromised npm publishing credential to push malicious versions (8.16–8.20) of Jscrambler’s npm package starting July 11; the first clean version is 8.22. The poisoned versions — downloaded 1,479 times before removal — used a preinstall hook to drop Rust-based infostealer binaries for Linux, macOS, and Windows that harvest developer credentials, cloud secrets, cryptocurrency wallets, AI coding-assistant and MCP server configurations, and browser data, exfiltrating over TLS. Dependent packages including jscrambler-webpack-plugin, gulp-jscrambler, grunt-jscrambler, and jscrambler-metro-plugin were also affected. Users should remove affected versions, scan for malware, and rotate all credentials and API keys.

“Our investigation indicates that the attacker was able to publish the package using an NPM publishing credential. We have revoked and rotated all relevant credentials, passwords, and secrets, and have implemented additional security controls around our publishing process while the investigation continues.” — Jscrambler security advisory

Source: Jscrambler advisory, Socket · SecurityWeek

CISA adds 18-year-old Cisco IOS CSRF flaw to KEV catalog

CISA · July 13, 2026

CISA added CVE-2008-4128 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The 2008-era flaw comprises cross-site request forgery weaknesses in the HTTP administration interface of Cisco IOS 12.4 on Cisco 871 Integrated Services Routers, letting attackers trick authenticated admins into executing arbitrary commands. Under BOD 26-04, federal civilian agencies must remediate by July 16, 2026 — a reminder that long-lived admin interfaces on aging network gear remain an active attack surface.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” — CISA alert, July 13, 2026

Source: CISA alert, KEV catalog · SC Media

Still developing

Adobe / CISA · July 7–8, 2026 — Maximum-severity ColdFusion flaw CVE-2026-48282 (ColdFusion 2025.9, 2023.20 and earlier; unauthenticated remote code execution) was exploited within hours of Adobe’s patch release and added to CISA’s KEV catalog on July 7 with a three-day federal remediation deadline. Shadowserver tracks nearly 800 ColdFusion instances still exposed online. Source: CISA alert · BleepingComputer

AssuranceAmerica · July 9, 2026 — The U.S. auto insurer disclosed a breach affecting 6,998,886 people after attackers compromised an employee’s credentials in March and copied files containing names, contact details, policy and claims data, and driver’s license numbers — the largest U.S. driver’s-license breach disclosed this year. Source: BleepingComputer

This brief covers the trailing ~48 hours (July 12–14, 2026).
Primary sources: Microsoft MSRC (CVE-2026-56155) · Microsoft MSRC (CVE-2026-56164) · SAP Security Patch Day July 2026 · Jscrambler security advisory · Socket research · CISA KEV alert (July 13) · CISA KEV catalog