When Wiz recently published its roundup of the Best Vulnerability Management Tools for 2026, something caught our attention, but didn’t surprise us: OPENVAS received a top spot and a great review. Wiz describes OPENVAS as the “open-source equivalent” to commercial vulnerability scanners. The review calls OPENVAS “the most comprehensive coverage available in a single platform”. We’ll take the compliment! But there are still a few points we would like to contest because they don’t quite capture the full Greenbone story.

What Wiz Reviewed

Wiz reviewed Greenbone’s free community edition of OPENVAS SCAN, which is appropriate for a review of open-source software (OSS) tools. However, the community edition comes with the limits of a free tier. OPENVAS is also available as an end-to-end enterprise product. Let’s review the differences:

	Community Edition	Enterprise Products
Setup	Installed from containers, Linux packages, or source code	Pre-configured and optimized virtual and hardware appliances
Detection feed	Selected consumer and OSS security checks	Extended list of OSS such as additional Linux distributions and Cisco, Microsoft, SAP, Fortinet, Citrix, and many more enterprise software products
Compliance	IT-Grundschutz	IT-Grundschutz, CIS Benchmarks, BSI-TR technical guidelines, and additional policy sets such as Post-Quantum Cryptographic policy scans
Update cadence	Regular updates	Daily updates
Service and support	Volunteer members of the Greenbone community forum	Guaranteed service and support response times with a Service Level Agreement (SLA), plus Professional Services

Open Source and Enterprise: Greenbone Is “Best of Both Worlds”

One of Greenbone’s biggest advantages is that organizations do not have to choose between open-source transparency and enterprise-grade deployment. Greenbone offers both sides of the equation: the transparency and flexibility associated with open-source software and purpose-built enterprise solutions designed for operational security environments. The openness matters. Source-code transparency provides visibility into the OPENVAS SCAN technology. This visibility simplifies security auditing and independent security testing.

The Greenbone ecosystem includes multiple community edition deployment options. Users can run the Community Containers, install natively on Kali Linux, or build components directly from source. But community deployments are only a small part of the Greenbone product offering. Greenbone provides optimized enterprise solutions for organizations that need commercially supported vulnerability management products. Our product line includes enterprise virtual appliances and dedicated hardware appliances.

You Don’t Need to Run Nmap Separately

Wiz correctly highlights Nmap as a robust discovery tool, noting that security practitioners rely on the tool for port scanning. But users don’t need to feed Nmap results into our scanner. Nmap scanning is already integrated into OPENVAS SCAN. Our scan workflow performs robust port discovery before vulnerability assessment.

OPENVAS SCAN includes configurable options for port detection that security teams can tune according to the requirements of the target environment. There is no need to stitch together separate service-discovery and vulnerability detection operations.

More Control Means a More Sophisticated Configuration

In addition to saying that OPENVAS has a “user-friendly console for intuitive control”, Wiz also claims that OPENVAS demands a steep learning curve. There may be some truth to that observation. On the flip side, OPENVAS SCAN is a sophisticated security platform with flexible features. Vulnerability management itself is sophisticated. Giving security teams more options for scan control inevitably introduces more flexibility than a scanner built around a simplified workflow.

OPENVAS SCAN provides granular scan controls and flexible options for configuring targets, scanning behavior, schedules, credentials, results, and operational workflows. For organizations that want automation or integration with virtually any other IT platform, the Greenbone Management Protocol (GMP) and Open Scanner Protocol (OSP) APIs enable extensive programmatic control over OPENVAS SCAN.

Yes, mastering a flexible security platform requires some learning. However, the payoff is that defenders can leverage versatility across very different operational contexts.

Prioritization Goes Beyond Finding CVEs

Finding vulnerabilities is only the first part of vulnerability management. Wiz correctly states that prioritization requires more context than raw severity alone. OPENVAS SCAN already provides important prioritization data, including CVSS severity information, EPSS exploit-probability scores, and CISA Known Exploited Vulnerabilities (KEV) status, helping defenders move from “What vulnerabilities exist?” toward “Which vulnerabilities deserve attention first?” And more risk prioritization tools are on the way!

Without giving away the details just yet, Greenbone will soon be announcing new risk-management capabilities designed to give defenders even better tools to understand, organize, and prioritize vulnerability risk.

Industry Leading Coverage and a Growing List of Scanning Tools

Wiz claims that OPENVAS has “limited coverage, scanning only basic endpoints and networks”. However, Greenbone’s subscription-based detection feed, the OPENVAS ENTERPRISE FEED, provides industry-leading vulnerability detection. Meanwhile, the OPENVAS COMMUNITY FEED provides extensive security coverage for Linux environments and many other widely deployed open-source applications and software stacks.

OPENVAS SCAN is not simply performing a network-surface sweep of a few endpoints. Authenticated scanning delves deep into user space to detect vulnerabilities that cannot be identified from the outside. Containers must also be checked for vulnerabilities in the same way as other IT assets. OPENVAS SCAN can perform container image scans to audit a single container image, multiple container images, or a complete registry.

Since its founding in 2009, Greenbone AG has continuously maintained and advanced the Open Vulnerability Assessment System, better known as OpenVAS. As a result, the two names have become closely linked: mention Greenbone, and OpenVAS is often the first thing that comes to mind. Formerly known as the Greenbone Vulnerability Manager (GVM), OPENVAS SCAN has continued to evolve as well. Important feature upgrades include agent-based and hybrid scanning to complement the traditional agentless authenticated scanning model, container image scanning. Also, a new generation of risk-management capabilities are almost ready to hit the center stage. Greenbone’s product line is also expanding with OPENVAS SECURITY INTELLIGENCE, a new enterprise tool for centralized management, risk analysis, and remediation prioritization across distributed OPENVAS SCAN environments.

Yes, Windows and Linux, but So Much More!

Wiz also claims that OPENVAS is “primarily optimized for Linux and Windows operating systems.” But, that description overlooks how flexible Greenbone deployment actually is. OPENVAS SCAN can be deployed across a range of virtualization environments including, Oracle VirtualBox for macOS and type-1 hypervisors such as VMware ESXi, Proxmox Virtual Environment and Nutanix AHV.

Our supported hypervisor options include:

• Microsoft Hyper-V, version 8.0 or higher
• VMware vSphere Hypervisor (ESXi), version 7.0 or higher
• VMware Workstation Pro, version 17.0 or higher
• Oracle VirtualBox, version 7.0 or higher
• Huawei FusionCompute, version 8.0
• Proxmox Virtual Environment (VE), version 8.0 or higher
• Nutanix AHV, version 6.8 or higher

Already running Proxmox VE or Nutanix AHV? See how OPENVAS SCAN covers your hypervisor.

A Concluding Thanks to Wiz!

Even Wiz loves Greenbone! Here at Greenbone, we appreciate being listed among the leading vulnerability-management technologies for 2026. The Wiz review recognizes what many of our customers and users already know: OPENVAS is the pinnacle of industry-leading, open-source vulnerability-management platforms. We are also happy to help clarify a few parts of that picture.

Let’s be clear: Greenbone’s open-source transparency goes hand-in-hand with top-notch enterprise deployment. Vulnerability management extends far beyond default scan configurations and push-button scans. Sure, OPENVAS SCAN has these. But powerful configuration options should not be mistaken for unnecessary complexity. Greenbone’s existing risk-prioritization tools support defenders with core risk metrics after vulnerabilities have been discovered.

Be on the lookout for several new features that will extend the number of options that defenders have for prioritized risk-driven vulnerability management and exposure management! Contact Greenbone’s sales team to discuss how enterprise-grade compliance scanning with OPENVAS SCAN can best support your organization’s regulatory and security governance requirements.

 

Broadcom published VMSA-2026-0006 on July 29th, 2026, to address five vulnerabilities affecting VMware ESX, VMware vCenter Server, VMware Workstation, and VMware Fusion. The highest-risk issues are CVE-2026-59309 (CVSS 9.8) and CVE-2026-59310 (CVSS 9.8) affecting VMware vCenter Server. Both can be exploited by an unauthenticated attacker with network access to achieve remote code execution (RCE).

Technical details for CVE-2026-59310 and CVE-2026-59309 were published immediately after their disclosure, but no proof-of-concept exploits are publicly available. On August 11th, Defused Cyber reported probing for CVE-2026-59309. QUIRSO GmbH reports that in-the-wild exploitation of CVE-2026-59309 and CVE-2026-59310 is already underway [1][2][3]. Neither CVE is on CISA’s Known Exploited Vulnerabilities (KEV) list. Numerous national CERT agencies have issued alerts [4][5][6][7][8][9][10][11][12][13][14][15][16][17][18].

The VMSA-2026-0006 advisory also disclosed three additional flaws. CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write flaw affecting the ESX VMXNET3 network adapter. Exploitation can allow a guest administrator to execute code on the host. The other two flaws are CVE-2026-41703 (CVSS 7.6) affecting VMware ESX, Workstation, and Fusion, and CVE-2026-41709 (CVSS 2.7) affecting ESX.

A Risk Assessment of VMware vCenter and ESX Vulnerabilities in VMSA-2026-0006

Technical details for CVE-2026-59310 and CVE-2026-59309 affecting VMware vCenter Server were published immediately after their disclosure, but no proof-of-concept exploits are publicly available. Both CVEs can be exploited remotely by an attacker without authentication. Public reporting indicates that in-the-wild exploitation of both CVEs is already underway [1][2][3].

VMware vCenter Server poses high risk because it provides centralized management of virtualized hosts and virtual machines from a single console. In practical terms, a compromise of VMware vCenter Server can affect a management layer for critical virtual machine hosts and workloads.

The ESX issues present a different but still important risk profile. CVE-2026-47876 requires local administrative control inside a guest VM that uses the VMXNET3 adapter. However, the consequence is high—host-level code execution. CVE-2026-41703 requires VM deployment privileges and can cause information disclosure or trigger a Denial of Service (DoS) condition in the host process. CVE-2026-41709 is low severity, but it weakens audit visibility by allowing certain administrator actions to bypass logging.

CVE-2026-59309: Actively Exploited vCenter Authentication Bypass

CVSS 9.8 · CriticalActively exploited

An attacker with network access to VMware vCenter Server can bypass authentication and gain unauthorized access to the system. The root cause is incorrect implementation of an authentication algorithm [CWE-303]. The flaw affects the VMware Directory Service.

CVE-2026-59310: Actively Exploited vCenter Directory Traversal RCE

CVSS 9.8 · CriticalActively exploited

A directory traversal flaw in the VMware vCenter Server Syslog component allows an unauthenticated remote attacker to execute arbitrary code. The root cause is improper limitation of a pathname to a restricted directory [CWE-22].

Other CVEs Disclosed in VMSA-2026-0006

The VMSA-2026-0006 advisory also disclosed three additional, lower-severity flaws affecting VMware ESX, Workstation, and Fusion:

The three additional CVEs disclosed in VMSA-2026-0006, each shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-47876

CVSS 9.3 · Critical EPSS 0.281% (20th)

A critical out-of-bounds memory write condition [CWE-787] in the VMware ESX VMXNET3 virtual network adapter. Exploitation allows an attacker with local admin privileges on a VM to execute code on the ESX host. The flaw only affects guest VMs using the default VMXNET3 adapter. Other network adapters are not reported to be affected by CVE-2026-47876.

CVE-2026-41703

CVSS 7.6 · High EPSS 0.556% (44th)

An out-of-bounds read flaw [CWE-125] that allows information disclosure or DoS of the host process. Exploitation requires VM deployment privileges. CVE-2026-41703 affects VMware ESX as well as VMware Workstation and Fusion. Broadcom reports that the impact on VMware Workstation and VMware Fusion is restricted to information disclosure.

CVE-2026-41709

CVSS 2.7 · Low EPSS 0.382% (31st)

A low-severity issue in VMware ESX causes certain operations not to be logged [CWE-778].

Mitigation for CVEs Disclosed in VMSA-2026-0006

Organizations should map their installed versions to the affected and fixed releases in Broadcom’s VMSA-2026-0006 advisory and apply the vendor-provided updates. No workarounds are available for any of the CVEs.

CVE-2026-59309 and CVE-2026-59310 are the most urgent because both are exploitable to an unauthenticated attacker with network access to an affected VMware vCenter instance. CVE-2026-47876 should be prioritized where VMware ESX guest VMs use the VMXNET3 adapter because exploitation allows virtual machine escape and code execution on the ESX host. CVE-2026-41703 should have increased priority for VMware ESX instances that manage critical operations since it can be exploited to trigger DoS conditions. The VMware ESX flaw CVE-2026-41709 should be patched where audit completeness is important.

Summary

Broadcom’s VMSA-2026-0006 bundles five VMware vulnerabilities across VMware vCenter Server, VMware ESX, VMware Workstation, and VMware Fusion. The highest-risk exposure is concentrated in CVE-2026-59310 and CVE-2026-59309. Both are critical-severity and actively exploited flaws affecting VMware vCenter Server [1][2][3].

Greenbone’s OPENVAS ENTERPRISE FEED addresses CVE-2026-59309 and CVE-2026-59310 with a remote banner version check for VMware vCenter Server. It also includes VMware ESXi package-level detection for CVE-2026-41703 [1], CVE-2026-47876 [2], and CVE-2026-41709 [3]. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.

 

Plenty of new risks to enterprise IT defenders emerged in July 2026. Earlier this month, our blog covered emerging issues such as active exploitation of WordPress Core [2], Adobe ColdFusion [3] and Check Point SmartConsole [4]; new critical-severity flaws in Cisco products [5], BeyondTrust RS and PRA [6], and Citrix NetScaler ADC and Gateway [7]; and a flood of Linux CVEs that include new active exploitation [8][9]. In this blog post, we will briefly examine the so-called “vulnpocolypse“ and cover the highest-risk software vulnerabilities that have not already been covered on our blog.

For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.

For those embroiled in the AI cyber security hype cycle, waves of AI vulnerability reports are swamping inboxes. Even defenders focused simply on patching and protecting their IT infrastructure have been inundated by unusually voluminous vulnerability disclosures affecting widely deployed software [1][2][3][4]. Are we waiting for the dust to settle, or will the storm gain even more momentum?

It’s prudent to ask: Is the so-called “vulnpocolypse” making an everlasting dent in the number of software bugs that defenders need to fear going forward? Or is the IT industry merely scratching the surface of accumulated technical debt? Again, only time will reveal the true level of exposure. Finally, as CISA points out in its new security guidance for Open Source Software, trust should be a key driver when selecting and deploying enterprise software.

CVE-2026-6875: ServiceNow AI Platform Actively Exploited

CVE-2026-6875 (CVSS 7.6, EPSS ≥ 98th pctl) allows an unauthenticated attacker to achieve remote code execution (RCE) by escaping the server-side script sandbox in the ServiceNow AI Platform if the assessment_thanks.do endpoint is reachable. The unauthenticated assessment_thanks.do endpoint passes the attacker-controlled sysparm_assessable_type parameter into the GlideRecord.addQuery() function. Values prefixed with javascript: are evaluated in ServiceNow’s Rhino script sandbox. Attackers can leverage the gs.include() function and shared global JavaScript objects to escape the sandbox boundary.

Exploitation allows full compromise of a ServiceNow instance and connected proxy servers. In-the-wild exploitation has been reported. Although CVE-2026-6875 is not on CISA’s KEV list, two previous ServiceNow CVEs were added in 2024. A public proof-of-concept exploit and detailed technical analysis are available, increasing the risk of cyber attacks. Several national CERT agencies have issued alerts for CVE-2026-6875 [1][2][3][4][5].

No workaround mitigations are described by the vendor. However, a Cloud Security Alliance (CSA) report refers to standard mitigation measures: restricting network access via firewall rules, or using web application firewall (WAF) to block exploitation attempts. Self-hosted ServiceNow users must upgrade to Australia Patch 2; Yokohama Patch 12 Hot Fix 1b or Patch 13; Zurich Patch 7b or Patch 9; or Brazil EA or GA. Patched releases remove the vulnerable behavior and introduce a sandbox-hardening feature named Guarded Script. ServiceNow also recommends reviewing logs for suspicious unauthenticated script execution or access to the assessment_thanks.do endpoint.

Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner check to identify ServiceNow instances affected by CVE-2026-6875.

Emerging Risks to Microsoft Products: More Active Exploitation

Microsoft products faced renewed exploitation pressure in July, led by actively exploited SharePoint flaws. A public PoC for an Exchange Server vulnerability adds further urgency for defenders.

CISA Warns of Microsoft SharePoint Exploit Campaigns

An out-of-band Microsoft security advisory in July 2026 disclosed 37 unique CVEs affecting SharePoint, with impacts such as RCE, privilege escalation, spoofing, and information disclosure. In July, CISA also warned that threat actors are leveraging several CVEs in Microsoft SharePoint Server Subscription Edition, 2019, and 2016 to gain unauthorized access and achieve RCE. Post-exploitation activity includes stealing IIS machine keys, abusing ASP.NET view state deserialization, and deploying malware.

The highest-risk SharePoint CVEs published in July 2026 are:

• CVE-2026-58644 (CVSS 9.8, EPSS ≥ 91st pctl): A remote attacker authenticated as a Site Owner or higher privilege level can execute arbitrary code on a Microsoft SharePoint Server. The flaw is caused by deserialization of untrusted data [CWE-502]. CVE-2026-58644 is considered actively exploited in the wild and was added to CISA’s KEV catalog two days after disclosure. Neither a public PoC exploit nor a full technical analysis is yet available for CVE-2026-58644.
• CVE-2026-50522 (CVSS 9.8, EPSS ≥ 99th pctl): Allows an unauthorized attacker to execute code over a network. The root cause is deserialization of untrusted data [CWE-502]. CVE-2026-50522 has been added to CISA’s KEV list.
• CVE-2026-56164 (CVSS 9.8, EPSS 97th pctl): Allows an unauthorized attacker to elevate privileges over a network. The root cause is missing authentication for a critical function [CWE-306]. Neither CISA or Microsoft have reported active exploitation. Detailed technical descriptions or PoC exploits are not publicly available.
• CVE-2026-55040 (CVSS 9.1, EPSS ≥ 69th pctl): Weak authentication [CWE-1390] allows an unauthorized attacker to bypass a security feature over a network. Neither CISA or Microsoft have reported active exploitation. Detailed technical descriptions or PoC exploits are not publicly available.

CISA’s alert on new attacks targeting SharePoint provides additional recommendations for defenders. These include shortening patching cycles, enabling Antimalware Scan Interface (AMSI) for each SharePoint site, restricting SharePoint Central Administration, farm and database communications to only required systems, avoiding exposure of SharePoint Servers to the public internet, and more. Organizations should patch promptly because exposed SharePoint servers remain attractive enterprise targets. Greenbone’s OPENVAS ENTERPRISE FEED includes regular vulnerability detection across many Microsoft products, including all the CVEs referenced above.

CVE-2026-45504: Public PoC Exploit for Microsoft Exchange Server 2019

CVE-2026-45504 (CVSS 8.8) allows authenticated, low-privileged users to read arbitrary files from on-premises Microsoft Exchange Server 2019. The CVE is classified as a Server-Side Request Forgery (SSRF) flaw [CWE-918]. The root cause is missing URL scheme validation in the OneDrive and WOPI integration. Using a malicious Exchange Web Services (EWS) reference attachment and WOPI response, an attacker can force Exchange to process a malicious file URI. Exploitation allows an attacker to bypass appended OAuth parameters and gain access to configuration files, credentials, and other sensitive local data.

No active exploitation, ransomware use, or associated campaigns have been reported. However, a detailed technical analysis and PoC exploit code are publicly available, increasing the risk. Several national CERT agencies have issued alerts for CVE-2026-45504 [1][2][3][4][5][6][7][8]. For defenders seeking to detect and protect, the OPENVAS ENTERPRISE FEED includes:

• A remote version check for Microsoft Exchange Server 2016, Server 2019, and Subscription Edition (SE)
• An executable version check for Microsoft Exchange Server 2016 Cumulative Update 23
• Executable version checks for Microsoft Exchange Server 2019 Cumulative Update 14 and 15 [1][2]

Living on the Edge: Emerging Threats to Perimeter Security

Vulnerabilities in network perimeter devices are particularly high risk because they are exposed to attack by arbitrary remote attackers. According to the latest Verizon DBIR 2026 report, exploiting publicly exposed software vulnerabilities is now the most common vector for initial access globally. Here are some of the most critical emerging threats to perimeter devices in July 2026.

SonicWall SMA 1000 Appliances Actively Exploited

CVE-2026-15409 and CVE-2026-15410 were both published on July 14th, 2026, and added to CISA’s KEV list on the same day [1][2]. The CVEs affect SonicWall Secure Mobile Access (SMA) 1000 Series models 6210, 7210, and 8200v. According to a forensic report, exploitation of the flaws began well before their disclosure. Full technical analysis [3][4] and PoC exploits [5][6] are available for CVE-2026-15409. Numerous national CERT agencies have issued alerts globally [7][8][9][10][11][12][13][14][15][16][17][18][19][20]. SonicWall SMA 1000 is on CISA’s KEV list 17 times, 10 entries associated with ransomware attacks, indicating high risk.

The SMA 1000 Series functions as an enterprise secure-access gateway that combines SSL VPN and Zero Trust controls to connect remote users to internal, cloud-hosted, and hybrid applications. Details on each new actively exploited CVE are included below:

• CVE-2026-15409 (CVSS 10, EPSS = 100th pctl): A maximum-severity flaw that allows unauthenticated attackers to execute Server-Side Request Forgery (SSRF) [CWE-918] attacks via the Work Place interface. The root cause is a vulnerable /wsproxy endpoint that processes User-Agent and bmID values to establish WebSocket tunnels to services accessible only through the appliance’s loopback interface.
• CVE-2026-15410 (CVSS 7.2, EPSS ≥ 99th pctl): Allows authenticated administrators to inject code into the Appliance Management Console to execute arbitrary OS commands [CWE-94] with root-level privileges. The root cause is a flawed hotfix-removal workflow that allows path traversal [CWE-35] to execute an attacker-supplied shell script as root.

Chaining the two flaws provides unauthenticated, root-level control of an affected SMA 1000 appliance as described below:

• Initial access: An unauthenticated attacker exploits CVE-2026-15409 in the /wsproxy WebSocket proxy by supplying a crafted host parameter, forcing the appliance to connect to local-only services such as the internal Erlang process on port 1050.
• Privilege escalation: The attacker then exploits CVE-2026-15410 by sending a path-traversal payload to rollbackConfirm.action, causing the hotfix-removal workflow to execute an attacker-provided shell script as root before rebooting.

After gaining root, the attackers deployed custom malware for code execution and covert tunneling, installed web shells for remote access, and added persistence mechanisms to maintain root access. Malicious Java components were injected into a legitimate SonicWall process to evade routine monitoring, and packet-capture tooling was used to collect LDAP credentials and expand access to internal directory services [21].

No workarounds are described by the vendor. SonicWall strongly recommends immediately installing the applicable platform hotfix and investigating for signs of compromise. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner version check to detect both CVEs and an active check specific to CVE-2026-15409.

CVE-2026-20316: Cisco Secure Firewall Management Center (FMC) Actively Exploited

CVE-2026-20316 (CVSS 5.3) allows an unauthenticated, remote attacker to log in to an affected device as a low-privileged user via hardcoded user credentials [CWE-259]. The flaw affects the web interface of Cisco Secure Firewall Management Center (FMC) Software. Several cyber security experts expressed shock that hardcoded credentials remain in Cisco products.

CVE-2026-20316 is being actively exploited and was added to CISA’s KEV list the same day it was disclosed. The nominal CVSS score of 5.3 understates the operational risk. Cisco has assigned CVE-2026-20316 a Security Impact Rating (SIR) of High and specifically warns that the flaw can be combined with other FMC vulnerabilities to elevate privileges on unpatched devices. Several national CERT agencies have issued alerts for CVE-2026-20316 [1][2][3][4][5].

Cisco Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 are affected. Cisco has released hotfix patches for affected products. If patches cannot be applied, risk can be reduced by preventing public internet access to the FMC management interface. The OPENVAS ENTERPRISE FEED includes a remote banner check, allowing defenders to identify vulnerable devices.

New High-Risk Flaws Affecting Palo Alto Networks PAN-OS

Palo Alto Networks has released patches for 13 new CVEs. Eleven of the CVEs affect PAN-OS and various components that run on the operating system. The most critical new CVEs from Palo Alto Networks’ July 2026 disclosures are:

• CVE-2026-0284 (CVSS 9.9): An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of PAN-OS enables an unauthenticated attacker with network access to inject malicious XML content. Exploitation allows information disclosure or corruption of internal LSVPN satellite data.
• CVE-2026-0288 (CVSS 7.5): Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of PAN-OS allows an unauthenticated attacker with network access to cause a Denial of Service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses

There are no reports of active exploitation for the new CVEs. However, organizations should promptly apply the latest updates and restrict access to sensitive services, particularly the User-ID Terminal Server Agent. See Palo Alto Networks’ security advisory page for affected versions and patches. Greenbone’s OPENVAS ENTERPRISE FEED includes authenticated scan detection for all of Palo Alto Networks’ new CVEs that impact PAN-OS and its components.

Two New Flaws Affecting Gitea Include Exploitation Attempts

Two new Gitea vulnerabilities present elevated risk among nine newly disclosed flaws. Of these, Sysdig has reported in-the-wild exploitation attempts targeting CVE-2026-20896.

Here are the details for both emerging high-risk CVEs:

• CVE-2026-20896 (CVSS 9.8): Unauthenticated remote attackers can bypass reverse-proxy authentication [CWE-284] to access repositories and secrets. Gitea’s official Docker image uses an app.ini template that hard-codes a wildcard allowlist (REVERSE_PROXY_TRUSTED_PROXIES=* ). Exploitation requires only access to the Gitea port and a valid username. CVE-2026-20896 is reportedly being actively exploited against internet-accessible instances. Several PoC exploits have been published [1][2][3]. Gitea’s official Docker images before version 1.26.3 are affected.
• CVE-2026-27771 (CVSS 8.2): Unauthenticated remote attackers can pull private container images. The root cause is a broken authorization design [CWE-862] in which anonymous JSON Web Tokens (JWTs) are accepted by ungated registry read endpoints, while package visibility was never bound to repository privacy. Exploitation may allow disclosure of credentials, API keys, TLS certificates, production configurations, and compiled source code. A detailed technical analysis [4] and PoC exploit code [5] are available. Gitea’s built-in OCI container registry before version 1.26.2 are affected.

An estimated ~31,000 Gitea instances are publicly exposed globally. The OPENVAS ENTERPRISE FEED includes a remote banner check and a remote application check for CVE-2026-20896 [6][7], as well as a separate remote banner check and an active check to identify Gitea instances affected by CVE-2026-27771 [8][9].

CVE-2026-63077: Critical Flaw Affecting JetBrains TeamCity On-Premises

CVE-2026-63077 (CVSS 9.8, EPSS ≥ 47th pctl) allows unauthenticated RCE against all previous versions of TeamCity On-Premises. The root cause is deserialization of untrusted data [CWE-502] in the agent polling protocol. Successful exploitation allows an attacker to execute commands with the privileges of the TeamCity server process. A compromise could expose stored credentials, alter build artifacts, and compromise downstream CI/CD pipelines.

No active exploitation, public PoC, or full exploit-level technical disclosure had been reported for CVE-2026-63077 as of August 1st, 2026. However, TeamCity has been added to CISA’s KEV list three times, each entry associated with ransomware attacks. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner version check to identify unpatched versions of TeamCity On-Premises. Organizations should update to version 2025.11.7 or 2026.1.3, or enable the automatic updates option within TeamCity. For organizations unable to upgrade, a security patch is available.

CVE-2026-14266: 7-Zip Flaw Allows Remote Code Execution

CVE-2026-14266 (CVSS 7.0) is a newly disclosed flaw affecting 7-Zip versions before 26.02. The flaw allows remote attackers to execute arbitrary code. The root cause is incorrect writable-space tracking in the XZ decoder, which can lead to a heap-based buffer overflow [CWE-122]. Each decoder invocation is incorrectly given the full output-buffer size, causing decoders to overestimate the remaining writable space after partial output. Exploitation requires a target to open a malicious XZ archive. The impact is code execution with the current user’s privileges.

There are no reports of active exploitation. However, a detailed technical write-up with a PoC exploit generator is publicly available. The existence of public PoC exploit generator, even in the early stages of development, means that low-skilled attackers may soon be able to leverage CVE-2026-14266 for real-world attacks. In fact, 7-Zip flaws are known to be used in social engineering cyber attacks [1][2].

Germany’s BSI and Italy’s ACN national CERT agencies have issued alerts for CVE-2026-14266 [3][4]. Users should upgrade to 7-Zip version 26.02 or later. The OPENVAS ENTERPRISE FEED includes a Windows registry check to identify systems with 7-Zip installed. CVE-2026-14266 also impacts embedded 7-Zip components in third-party products. Greenbone will continue to add Linux package detection checks and other application-specific checks as downstream vendors issue security advisories.

CVE-2026-53412: Unauthenticated Remote Account Takeover Affecting Zoom Workplace

Zoom’s July 2026 security advisories disclose new flaws affecting Zoom Workplace and other core Zoom applications. The primary risk is CVE-2026-53412, which enables unauthenticated remote account takeover without user interaction and is described as having low attack complexity. No active exploitation has been reported, and no detailed technical analysis, or PoC exploits are publicly available.

• CVE-2026-53412 (CVSS 9.8): Allows an unauthenticated remote attacker to take over accounts through improper input validation. CVE-2026-53412 affects Zoom Workplace for Windows before 7.0.0 and Zoom Workplace VDI Client for Windows before the applicable fixed versions.
• CVE-2026-53410 (CVSS 7.0): Allows an authenticated local attacker to escalate privileges through a Time-of-Check to Time-of-Use (TOCTOU) race condition in the installation or removal processes of multiple Zoom Windows products. Affected products include Zoom Workplace, VDI Client, VDI Plugin, Zoom Rooms, and Remote Control for Zoom Contact Center for Windows.

Greenbone’s OPENVAS ENTERPRISE FEED includes registry checks to identify installations of Zoom Workplace for Windows that are vulnerable to CVE-2026-53412 [1] or CVE-2026-53410[2].

Summary

Emerging cyber security risks in July 2026 show attackers exploiting high-impact flaws across enterprise platforms, perimeter devices, development tools, and widely used applications. Amid the so-called “vulnpocolypse“ pressure, security teams should maintain high visibility and increase patch cadence with a priority given to exposed systems. Defense-in-depth becomes critical when attackers gain initial access.

For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.

 

CVE-2026-18577 (CVSS 8.2, EPSS ≥ 71st pctl) and CVE-2026-18556 (CVSS 7.4, EPSS ≥ 19th pctl), published in early August, have both been added to CISA’s Known Exploited Vulnerabilities (KEV) list within days of their disclosure [1][2]. N-able has published Indicators of Compromise (IoC) and post-exploitation activity from successful attacks against its own hosted N-central instances. N-central version 2026.3.1 is required to remediate both CVEs.

CVE-2026-18577 is considered a bypass of the fix for CVE-2026-18556. Both are authentication bypass [CWE-288] flaws that allow admin-level account takeover and full-platform compromise of N-central servers. No public proof-of-concept (PoC) exploit code or detailed technical analysis has been published for CVE-2026-18556 or CVE-2026-18577. Several national CERT agencies have published alerts for the CVEs [1][2][3][4][5][6][7].

A Risk Assessment of CVE-2026-18577 and CVE-2026-18556 Affecting N-able N-central

CVE-2026-18577

CVSS 8.2 · HighEPSS 1.5% (71st)Actively exploitedIn CISA KEV

CVE-2026-18556

CVSS 7.4 · HighEPSS 0.3% (19th)Actively exploitedIn CISA KEV

On July 31st, 2026, N-able detected malicious activity targeting N-central server in a customer environment. Analysis led to the discovery of a zero-day vulnerability, which was initially assigned CVE-2026-18556. The flaw was remediated in N-central 2026.2, but the fix left an alternate authentication-bypass path. N-able assigned CVE-2026-18577 to track the incomplete fix separately. N-central 2026.3 Hotfix 1 was released on August 2nd, which fully remediates both CVEs.

CVE-2026-18577 and CVE-2026-18556 are high risk because of N-central’s role as a remote administration platform in Managed Service Provider (MSP) environments. N-central includes tooling such as Take Control, Remote Desktop, Extensible Messaging and Presence Protocol (XMPP) control channels, and SSH access, among other services.

As evidenced by N-able’s reports of post-exploitation activity, compromise of an N-central server creates broad downstream risk across managed customer environments. Defenders should treat the issue as a platform-wide operational risk rather than limited to a single component or attack surface.

Multiple sources report that roughly 3,000 N-central servers were exposed to the public internet in 2025 [1][2]. Shodan currently identifies approximately 2,300 instances. This recent incident is not the first time that N-central has come under active exploitation. In mid-2025, CVE-2025-8875 (CVSS 7.8) and CVE-2025-8876 (CVSS 8.8) were both added to CISA’s KEV list [3][4].

Technical Assessment and Attack Trajectory

CVE-2026-18577 (CVSS 8.2, EPSS ≥ 71st pctl) is the result of an incomplete patch for CVE-2026-18556 (CVSS 7.4, EPSS ≥ 19th pctl), which was published only one day before CVE-2026-18577. Both flaws are described as authentication bypass vulnerabilities [CWE-288] affecting N-central instances. Post-exploitation reporting indicates that they allow admin-level account takeover and full-platform compromise. The vendor-supplied evidence does not include root-cause details or identify specific exploitable components. No further technical analysis or PoC exploits have been published.

N-able has published indicators of compromise (IoC) and post-compromise details from successful attacks on its hosted N-central infrastructure. These include a rogue file named svchost.exe in the user’s Documents folder, a registered service named Cloudflared, and inbound connections from several IP addresses. For defenders, this means that the patches should be paired with a full forensic review of exposed systems and monitoring of network traffic for anomalous activity.

Observed post-compromise activity included:

• Gaining administrative access to vulnerable N-central servers [T1190]
• Using N-central’s Take Control function to access connected systems remotely [T1219.002]
• Installing a rogue service [T1543.003] named Cloudflared on managed endpoints for persistent remote access even after access through the N-central server was revoked

CVE-2026-18577 & CVE-2026-18556: Affected Versions and Mitigation

Defenders should be primarily concerned about CVE-2026-18577 since it is a bypass of an earlier flaw. CVE-2026-18577 affects all N-central instances prior to version 2026.3.1. N-able’s status page states that hosted N-central instances are upgraded automatically. However, self-hosted customers must apply the 2026.3 Hotfix 1, identified as build 2026.3.1.7.

Deployment	Affected versions	Fixed versions	Upgrade path
Hosted N-central	All versions before 2026.3.1	N-central 2026.3 HF1, build 2026.3.1.7	Automatic update by N-able
Self-hosted N-central	All versions before 2026.3.1	N-central 2026.3 HF1, build 2026.3.1.7	Manual update required

N-able has published IoCs for its own incident response forensic analysis. The IoC information suggests that responders review potentially impacted systems for a file named svchost.exe in the user’s Documents folder, a registered service named Cloudflared, and inbound connections from several observed IP addresses.

Summary

N-able has issued N-central 2026.3 HF1 to mitigate CVE-2026-18577, which affects all previous versions of N-central. Because N-central is an administrative platform used by MSPs to manage customer environments, the operational risk is high. Known IoCs are available from the analysis of real-world breaches. Defenders should pair hotfix deployment with a full forensic review of potentially compromised systems.

 

Several concerning vulnerabilities affecting Linux have emerged in recent months. The vulnerabilities include CISA Known Exploited Vulnerabilities (KEV) entries for CVE-2026-31431 (aka Copy Fail) [1], and an older flaw, CVE-2022-0492 [2]. However, a wave of concerning new vulnerabilities are associated with publicly available exploits or proof-of-concept (PoC) code. Collectively, the flaws represent local privilege escalation, container escape, arbitrary command execution as root, kernel heap corruption, and remote code execution (RCE). Linux users should regularly scan their infrastructure, conduct assessments to determine exposure, and prioritize patching to reduce risks to critical assets.

A Risk Assessment of Emerging Linux Kernel Vulnerabilities

In recent weeks, the Greenbone blog reviewed Copy Fail, a new actively exploited Linux vulnerability, along with Copy Fail 2 and Dirty Frag. Since then, several new vulnerabilities affecting the Linux kernel and core components have emerged, presenting significant operational risk within the Linux ecosystem.

A Technical Assessment of Emerging Linux Vulnerabilities

The following section reviews recently disclosed vulnerabilities affecting the Linux kernel and core components. Each section summarizes the underlying technical cause, available threat intelligence, potential temporary mitigations, and the upstream fixes.

CVE-2026-31705 Affecting ksmbd SMB Server

CVSS 9.8 · CriticalEPSS 0.4% (32nd)No known exploitationPatch available

CVE-2026-31705 (CVSS 9.8, EPSS ≥ 32nd pctl) is an out-of-bounds write in the Linux kernel ksmbd SMB server’s smb2_get_ea() path. A memset operation for 4-byte alignment runs without checking the remaining space. Exploitation allows compound SMB requests to overwrite adjacent kernel heap memory.

A detailed technical write-up is available online, increasing the risk to defenders [1]. No vendor provided workarounds have been published. However, shutting down KSMBD and/or unloading and blocking the ksmbd kernel module can reasonably prevent attacks from reaching the affected components. Upstream fixes are incorporated into Linux kernel versions 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31705 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CVE-2026-55200 Affecting libssh2

CVSS 8.3 · HighEPSS 2.0% (79th)Public PoC

CVE-2026-55200 (CVSS 8.3, EPSS ≥ 79th pctl) affects libssh2. The flaw is an out-of-bounds write in ssh2_transport_read() caused by an unchecked attacker-controlled packet_length field. A malicious or compromised SSH server can send crafted SSH packets to trigger memory corruption and achieve RCE.

Detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2]. No workaround mitigation is available except for preventing libssh2 clients from connecting to untrusted SSH servers, such as disabling the service. CVE-2026-55200 affects all libssh2 versions up to and including 1.11.1. No fixed upstream release has yet been published, but the correction is available in upstream commit 97acf3df and has been backported by some Linux distributions. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-55200 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Fragnesia: CVE-2026-46300 (CVSS 7.5)

CVSS 7.8 · HighEPSS 2.5% (83rd)Public PoC

Dubbed Fragnesia, CVE-2026-46300 (CVSS 7.8, EPSS ≥ 83rd pctl) is caused by shared-fragment marker loss during skb coalescing in the Linux kernel’s net/skbuff and ESP input paths. Later in-place ESP processing allows decryption of page-cache-backed fragments. The issue is considered a trivial-to-exploit local privilege-escalation risk because it can corrupt page-cached read-only files. Ubuntu says exploitation can elevate a local user to root on affected hosts and that container-escape scenarios are also possible.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. Temporary mitigation can be achieved by unloading and blocking the esp4 and esp6 kernel modules [6]. CVE-2026-46300 affects Linux kernel versions 3.9 and later. Upstream fixes are incorporated into versions 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46300 and continues to add package-level checks as Linux distributions issue security advisories and patches.

ssh-keysign-pwn: CVE-2026-46333 (CVSS 7.1)

CVSS 7.1 · HighEPSS 1.5% (72nd)Public PoC

Dubbed ssh-keysign-pwn, CVE-2026-46333 (CVSS 7.1, EPSS ≥ 72nd pctl) is a race in Linux kernel ptrace and process-exit handling. The issue centers around dumpability and mm teardown. During a privileged process exit, pidfd_getfd() can duplicate open file descriptors from the dying process. Exploitation can expose sensitive root-owned material, including SSH keys and password hashes. The public proof-of-concept for this issue requires the pidfd_getfd syscall; a system call that can duplicate a file descriptor from another process. The kernel fix requires the CAP_SYS_PTRACE capability to inspect or control another process when the target process is exiting, known as the “no-mm” case.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5][6]. Temporary mitigation can be achieved by blocking all unprivileged users or only for users without the CAP_SYS_PTRACE privilege from attaching to other processes using the ptrace() system call [7]. CVE-2026-46333 is a Linux kernel vulnerability rather than an OpenSSH flaw. Patches are incorporated into Linux kernel versions 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.89, 6.18.31, 7.0.8, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46333 and continues to add package-level checks as Linux distributions issue security advisories and patches.

DirtyDecrypt / DirtyCBC: CVE-2026-31635 (CVSS 7.5)

CVSS 7.5 · HighEPSS 0.8% (53rd)Public PoC

Dubbed DirtyDecrypt (and DirtyCBC), CVE-2026-31635 (CVSS 7.5, EPSS ≥ 53rd pctl) affects Linux kernels with CONFIG_RXGK compiled in and enabled. An inverted bounds check in RxRPC / RxGK response validation allows oversized RESPONSE authenticators to be accepted and passed deeper into processing. Secondary reporting says the flaw can overwrite page-cached privileged files and be used for local privilege escalation to root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. No vendor provided workarounds have been published. However, independent researchers have suggested unloading and blocking the rxrpc module as a temporary solution [6]. Upstream fixes for CVE-2026-31635 are incorporated into Linux kernel versions 6.18.23, 6.19.13, and 7.0. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31635 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CIFSwitch: CVE-2026-46243 (CVSS 7.1)

CVSS 7.1 · HighEPSS 0.4% (30th)Public PoC

Dubbed CIFSwitch, CVE-2026-46243 (CVSS 7.1, EPSS ≥ 30th pctl) affects cifs_spnego handling in the Linux kernel’s CIFS client. The issue allows userspace to forge cifs.spnego key descriptions through request_key(2) or add_key(2), causing cifs.upcall to trust attacker-controlled authority fields. The flaw allows a low-privilege local user to trigger arbitrary command execution as root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. The temporary workaround is to unload and block the cifs kernel module, remove cifs-utils, or deactivate the cifs.spnego request-key rule [5]. CVE-2026-46243 affects Linux kernel with the CIFS client or cifs-utils, and the cifs.spnego request-key integration. Upstream fixes are incorporated into versions 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46243 and continues to add package-level checks as Linux distributions issue security advisories and patches.

PinTheft: CVE-2026-43494 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.3% (22nd)Public PoC

Dubbed PinTheft, CVE-2026-43494 (CVSS 7.8) affects the Linux kernel RDS zerocopy send path. The bug stems from cleanup logic that frees already released pages after op_nents is left nonzero. The exploit chain uses io_uring fixed buffers to overwrite the page cache of a SUID-root binary.

Several detailed write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. Workaround mitigation can be achieved by ensuring that the rds module is unloaded and blocked from automatic loading [5]. CVE-2026-43494 affects Linux kernel versions 4.17 and later with the RDS subsystem. Upstream fixes are incorporated into Linux kernel versions 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43494 and continues to add package-level checks as Linux distributions issue security advisories and patches.

GhostLock: CVE-2026-43499 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.7% (50th)Public PoC

Dubbed GhostLock, CVE-2026-43499 (CVSS 7.8) is a use-after-free in the Linux kernel rtmutex slowlock and proxy-lock rollback path. The remove_waiter() function leaves a dangling pointer and unsafe locking state. Red Hat and Ubuntu describe local privilege-escalation and denial-of-service impact [1][2], and Nebula says container escape is also possible on unpatched systems.

Several detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. No workaround mitigation is available. CVE-2026-43499 affects Linux kernel versions 2.6.39 and later with upstream fixes incorporated into versions 5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43499 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Mitigation for Emerging Linux Vulnerabilities

Organizations should prioritize patching for emerging Linux vulnerabilities based on the operational and business value of affected assets, the reachability of affected systems, each flaw’s technical details, and threat intelligence, including known active exploitation and the existence of PoC exploits.

Mitigating vulnerabilities found in the upstream Linux kernel depends on either implementing effective workarounds or installing updates in downstream Linux distributions when they become available. Where technical workarounds are not available, defenders must upgrade to fixed kernel builds.

Summary

Recent Linux kernel and core component vulnerabilities have exposed organizations to new risks. The potential impacts include local privilege escalation, container escape, arbitrary command execution, memory corruption, and RCE. Publicly available technical analyses and proof-of-concept exploits increase the urgency. When prioritizing patches, defenders must identify all affected systems and consider asset criticality, business risk, reachability, and exploitability.