Plenty of new risks to enterprise IT defenders emerged in July 2026. Earlier this month, our blog covered emerging issues such as active exploitation of WordPress Core [2], Adobe ColdFusion [3] and Check Point SmartConsole [4]; new critical-severity flaws in Cisco products [5], BeyondTrust RS and PRA [6], and Citrix NetScaler ADC and Gateway [7]; and a flood of Linux CVEs that include new active exploitation [8][9]. In this blog post, we will briefly examine the so-called “vulnpocalypse“ and cover the highest-risk software vulnerabilities that have not already been covered on our blog.

For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.

Threat Report July 2026: Vulnpocalypse

For those embroiled in the AI cyber security hype cycle, waves of AI vulnerability reports are swamping inboxes. Even defenders focused simply on patching and protecting their IT infrastructure have been inundated by unusually voluminous vulnerability disclosures affecting widely deployed software [1][2][3][4]. Are we waiting for the dust to settle, or will the storm gain even more momentum?

It’s prudent to ask: Is the so-called “vulnpocalypse” making an everlasting dent in the number of software bugs that defenders need to fear going forward? Or is the IT industry merely scratching the surface of accumulated technical debt? Again, only time will reveal the true level of exposure. Finally, as CISA points out in its new security guidance for Open Source Software, trust should be a key driver when selecting and deploying enterprise software.

CVE-2026-6875: ServiceNow AI Platform Actively Exploited

CVE-2026-6875 (CVSS 7.6, EPSS ≥ 98th pctl) allows an unauthenticated attacker to achieve remote code execution (RCE) by escaping the server-side script sandbox in the ServiceNow AI Platform if the assessment_thanks.do endpoint is reachable. The unauthenticated assessment_thanks.do endpoint passes the attacker-controlled sysparm_assessable_type parameter into the GlideRecord.addQuery() function. Values prefixed with javascript: are evaluated in ServiceNow’s Rhino script sandbox. Attackers can leverage the gs.include() function and shared global JavaScript objects to escape the sandbox boundary.

Exploitation allows full compromise of a ServiceNow instance and connected proxy servers. In-the-wild exploitation has been reported. Although CVE-2026-6875 is not on CISA’s KEV list, two previous ServiceNow CVEs were added in 2024. A public proof-of-concept exploit and detailed technical analysis are available, increasing the risk of cyber attacks. Several national CERT agencies have issued alerts for CVE-2026-6875 [1][2][3][4][5].

No workaround mitigations are described by the vendor. However, a Cloud Security Alliance (CSA) report refers to standard mitigation measures: restricting network access via firewall rules, or using web application firewall (WAF) to block exploitation attempts. Self-hosted ServiceNow users must upgrade to Australia Patch 2; Yokohama Patch 12 Hot Fix 1b or Patch 13; Zurich Patch 7b or Patch 9; or Brazil EA or GA. Patched releases remove the vulnerable behavior and introduce a sandbox-hardening feature named Guarded Script. ServiceNow also recommends reviewing logs for suspicious unauthenticated script execution or access to the assessment_thanks.do endpoint.

Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner check to identify ServiceNow instances affected by CVE-2026-6875.

Emerging Risks to Microsoft Products: More Active Exploitation

Microsoft products faced renewed exploitation pressure in July, led by actively exploited SharePoint flaws. A public PoC for an Exchange Server vulnerability adds further urgency for defenders.

CISA Warns of Microsoft SharePoint Exploit Campaigns

An out-of-band Microsoft security advisory in July 2026 disclosed 37 unique CVEs affecting SharePoint, with impacts such as RCE, privilege escalation, spoofing, and information disclosure. In July, CISA also warned that threat actors are leveraging several CVEs in Microsoft SharePoint Server Subscription Edition, 2019, and 2016 to gain unauthorized access and achieve RCE. Post-exploitation activity includes stealing IIS machine keys, abusing ASP.NET view state deserialization, and deploying malware.

The highest-risk SharePoint CVEs published in July 2026 are:

• CVE-2026-58644 (CVSS 9.8, EPSS ≥ 91st pctl): A remote attacker authenticated as a Site Owner or higher privilege level can execute arbitrary code on a Microsoft SharePoint Server. The flaw is caused by deserialization of untrusted data [CWE-502]. CVE-2026-58644 is considered actively exploited in the wild and was added to CISA’s KEV catalog two days after disclosure. Neither a public PoC exploit nor a full technical analysis is yet available for CVE-2026-58644.
• CVE-2026-50522 (CVSS 9.8, EPSS ≥ 99th pctl): Allows an unauthorized attacker to execute code over a network. The root cause is deserialization of untrusted data [CWE-502]. CVE-2026-50522 has been added to CISA’s KEV list.
• CVE-2026-56164 (CVSS 9.8, EPSS 97th pctl): Allows an unauthorized attacker to elevate privileges over a network. The root cause is missing authentication for a critical function [CWE-306]. Neither CISA or Microsoft have reported active exploitation. Detailed technical descriptions or PoC exploits are not publicly available.
• CVE-2026-55040 (CVSS 9.1, EPSS ≥ 69th pctl): Weak authentication [CWE-1390] allows an unauthorized attacker to bypass a security feature over a network. Neither CISA or Microsoft have reported active exploitation. Detailed technical descriptions or PoC exploits are not publicly available.

CISA’s alert on new attacks targeting SharePoint provides additional recommendations for defenders. These include shortening patching cycles, enabling Antimalware Scan Interface (AMSI) for each SharePoint site, restricting SharePoint Central Administration, farm and database communications to only required systems, avoiding exposure of SharePoint Servers to the public internet, and more. Organizations should patch promptly because exposed SharePoint servers remain attractive enterprise targets. Greenbone’s OPENVAS ENTERPRISE FEED includes regular vulnerability detection across many Microsoft products, including all the CVEs referenced above.

CVE-2026-45504: Public PoC Exploit for Microsoft Exchange Server 2019

CVE-2026-45504 (CVSS 8.8) allows authenticated, low-privileged users to read arbitrary files from on-premises Microsoft Exchange Server 2019. The CVE is classified as a Server-Side Request Forgery (SSRF) flaw [CWE-918]. The root cause is missing URL scheme validation in the OneDrive and WOPI integration. Using a malicious Exchange Web Services (EWS) reference attachment and WOPI response, an attacker can force Exchange to process a malicious file URI. Exploitation allows an attacker to bypass appended OAuth parameters and gain access to configuration files, credentials, and other sensitive local data.

No active exploitation, ransomware use, or associated campaigns have been reported. However, a detailed technical analysis and PoC exploit code are publicly available, increasing the risk. Several national CERT agencies have issued alerts for CVE-2026-45504 [1][2][3][4][5][6][7][8]. For defenders seeking to detect and protect, the OPENVAS ENTERPRISE FEED includes:

• A remote version check for Microsoft Exchange Server 2016, Server 2019, and Subscription Edition (SE)
• An executable version check for Microsoft Exchange Server 2016 Cumulative Update 23
• Executable version checks for Microsoft Exchange Server 2019 Cumulative Update 14 and 15 [1][2]

Living on the Edge: Emerging Threats to Perimeter Security

Vulnerabilities in network perimeter devices are particularly high risk because they are exposed to attack by arbitrary remote attackers. According to the latest Verizon DBIR 2026 report, exploiting publicly exposed software vulnerabilities is now the most common vector for initial access globally. Here are some of the most critical emerging threats to perimeter devices in July 2026.

SonicWall SMA 1000 Appliances Actively Exploited

CVE-2026-15409 and CVE-2026-15410 were both published on July 14th, 2026, and added to CISA’s KEV list on the same day [1][2]. The CVEs affect SonicWall Secure Mobile Access (SMA) 1000 Series models 6210, 7210, and 8200v. According to a forensic report, exploitation of the flaws began well before their disclosure. Full technical analysis [3][4] and PoC exploits [5][6] are available for CVE-2026-15409. Numerous national CERT agencies have issued alerts globally [7][8][9][10][11][12][13][14][15][16][17][18][19][20]. SonicWall SMA 1000 is on CISA’s KEV list 17 times, 10 entries associated with ransomware attacks, indicating high risk.

The SMA 1000 Series functions as an enterprise secure-access gateway that combines SSL VPN and Zero Trust controls to connect remote users to internal, cloud-hosted, and hybrid applications. Details on each new actively exploited CVE are included below:

• CVE-2026-15409 (CVSS 10, EPSS = 100th pctl): A maximum-severity flaw that allows unauthenticated attackers to execute Server-Side Request Forgery (SSRF) [CWE-918] attacks via the Work Place interface. The root cause is a vulnerable /wsproxy endpoint that processes User-Agent and bmID values to establish WebSocket tunnels to services accessible only through the appliance’s loopback interface.
• CVE-2026-15410 (CVSS 7.2, EPSS ≥ 99th pctl): Allows authenticated administrators to inject code into the Appliance Management Console to execute arbitrary OS commands [CWE-94] with root-level privileges. The root cause is a flawed hotfix-removal workflow that allows path traversal [CWE-35] to execute an attacker-supplied shell script as root.

Chaining the two flaws provides unauthenticated, root-level control of an affected SMA 1000 appliance as described below:

• Initial access: An unauthenticated attacker exploits CVE-2026-15409 in the /wsproxy WebSocket proxy by supplying a crafted host parameter, forcing the appliance to connect to local-only services such as the internal Erlang process on port 1050.
• Privilege escalation: The attacker then exploits CVE-2026-15410 by sending a path-traversal payload to rollbackConfirm.action, causing the hotfix-removal workflow to execute an attacker-provided shell script as root before rebooting.

After gaining root, the attackers deployed custom malware for code execution and covert tunneling, installed web shells for remote access, and added persistence mechanisms to maintain root access. Malicious Java components were injected into a legitimate SonicWall process to evade routine monitoring, and packet-capture tooling was used to collect LDAP credentials and expand access to internal directory services [21].

No workarounds are described by the vendor. SonicWall strongly recommends immediately installing the applicable platform hotfix and investigating for signs of compromise. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner version check to detect both CVEs and an active check specific to CVE-2026-15409.

CVE-2026-20316: Cisco Secure Firewall Management Center (FMC) Actively Exploited

CVE-2026-20316 (CVSS 5.3) allows an unauthenticated, remote attacker to log in to an affected device as a low-privileged user via hardcoded user credentials [CWE-259]. The flaw affects the web interface of Cisco Secure Firewall Management Center (FMC) Software. Several cyber security experts expressed shock that hardcoded credentials remain in Cisco products.

CVE-2026-20316 is being actively exploited and was added to CISA’s KEV list the same day it was disclosed. The nominal CVSS score of 5.3 understates the operational risk. Cisco has assigned CVE-2026-20316 a Security Impact Rating (SIR) of High and specifically warns that the flaw can be combined with other FMC vulnerabilities to elevate privileges on unpatched devices. Several national CERT agencies have issued alerts for CVE-2026-20316 [1][2][3][4][5].

Cisco Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 are affected. Cisco has released hotfix patches for affected products. If patches cannot be applied, risk can be reduced by preventing public internet access to the FMC management interface. The OPENVAS ENTERPRISE FEED includes a remote banner check, allowing defenders to identify vulnerable devices.

New High-Risk Flaws Affecting Palo Alto Networks PAN-OS

Palo Alto Networks has released patches for 13 new CVEs. Eleven of the CVEs affect PAN-OS and various components that run on the operating system. The most critical new CVEs from Palo Alto Networks’ July 2026 disclosures are:

• CVE-2026-0284 (CVSS 9.9): An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of PAN-OS enables an unauthenticated attacker with network access to inject malicious XML content. Exploitation allows information disclosure or corruption of internal LSVPN satellite data.
• CVE-2026-0288 (CVSS 7.5): Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of PAN-OS allows an unauthenticated attacker with network access to cause a Denial of Service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses

There are no reports of active exploitation for the new CVEs. However, organizations should promptly apply the latest updates and restrict access to sensitive services, particularly the User-ID Terminal Server Agent. See Palo Alto Networks’ security advisory page for affected versions and patches. Greenbone’s OPENVAS ENTERPRISE FEED includes authenticated scan detection for all of Palo Alto Networks’ new CVEs that impact PAN-OS and its components.

Two New Flaws Affecting Gitea Include Exploitation Attempts

Two new Gitea vulnerabilities present elevated risk among nine newly disclosed flaws. Of these, Sysdig has reported in-the-wild exploitation attempts targeting CVE-2026-20896.

Here are the details for both emerging high-risk CVEs:

• CVE-2026-20896 (CVSS 9.8): Unauthenticated remote attackers can bypass reverse-proxy authentication [CWE-284] to access repositories and secrets. Gitea’s official Docker image uses an app.ini template that hard-codes a wildcard allowlist (REVERSE_PROXY_TRUSTED_PROXIES=* ). Exploitation requires only access to the Gitea port and a valid username. CVE-2026-20896 is reportedly being actively exploited against internet-accessible instances. Several PoC exploits have been published [1][2][3]. Gitea’s official Docker images before version 1.26.3 are affected.
• CVE-2026-27771 (CVSS 8.2): Unauthenticated remote attackers can pull private container images. The root cause is a broken authorization design [CWE-862] in which anonymous JSON Web Tokens (JWTs) are accepted by ungated registry read endpoints, while package visibility was never bound to repository privacy. Exploitation may allow disclosure of credentials, API keys, TLS certificates, production configurations, and compiled source code. A detailed technical analysis [4] and PoC exploit code [5] are available. Gitea’s built-in OCI container registry before version 1.26.2 are affected.

An estimated ~31,000 Gitea instances are publicly exposed globally. The OPENVAS ENTERPRISE FEED includes a remote banner check and a remote application check for CVE-2026-20896 [6][7], as well as a separate remote banner check and an active check to identify Gitea instances affected by CVE-2026-27771 [8][9].

CVE-2026-63077: Critical Flaw Affecting JetBrains TeamCity On-Premises

CVE-2026-63077 (CVSS 9.8, EPSS ≥ 47th pctl) allows unauthenticated RCE against all previous versions of TeamCity On-Premises. The root cause is deserialization of untrusted data [CWE-502] in the agent polling protocol. Successful exploitation allows an attacker to execute commands with the privileges of the TeamCity server process. A compromise could expose stored credentials, alter build artifacts, and compromise downstream CI/CD pipelines.

No active exploitation, public PoC, or full exploit-level technical disclosure had been reported for CVE-2026-63077 as of August 1st, 2026. However, TeamCity has been added to CISA’s KEV list three times, each entry associated with ransomware attacks. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner version check to identify unpatched versions of TeamCity On-Premises. Organizations should update to version 2025.11.7 or 2026.1.3, or enable the automatic updates option within TeamCity. For organizations unable to upgrade, a security patch is available.

CVE-2026-14266: 7-Zip Flaw Allows Remote Code Execution

CVE-2026-14266 (CVSS 7.0) is a newly disclosed flaw affecting 7-Zip versions before 26.02. The flaw allows remote attackers to execute arbitrary code. The root cause is incorrect writable-space tracking in the XZ decoder, which can lead to a heap-based buffer overflow [CWE-122]. Each decoder invocation is incorrectly given the full output-buffer size, causing decoders to overestimate the remaining writable space after partial output. Exploitation requires a target to open a malicious XZ archive. The impact is code execution with the current user’s privileges.

There are no reports of active exploitation. However, a detailed technical write-up with a PoC exploit generator is publicly available. The existence of public PoC exploit generator, even in the early stages of development, means that low-skilled attackers may soon be able to leverage CVE-2026-14266 for real-world attacks. In fact, 7-Zip flaws are known to be used in social engineering cyber attacks [1][2].

Germany’s BSI and Italy’s ACN national CERT agencies have issued alerts for CVE-2026-14266 [3][4]. Users should upgrade to 7-Zip version 26.02 or later. The OPENVAS ENTERPRISE FEED includes a Windows registry check to identify systems with 7-Zip installed. CVE-2026-14266 also impacts embedded 7-Zip components in third-party products. Greenbone will continue to add Linux package detection checks and other application-specific checks as downstream vendors issue security advisories.

CVE-2026-53412: Unauthenticated Remote Account Takeover Affecting Zoom Workplace

Zoom’s July 2026 security advisories disclose new flaws affecting Zoom Workplace and other core Zoom applications. The primary risk is CVE-2026-53412, which enables unauthenticated remote account takeover without user interaction and is described as having low attack complexity. No active exploitation has been reported, and no detailed technical analysis, or PoC exploits are publicly available.

• CVE-2026-53412 (CVSS 9.8): Allows an unauthenticated remote attacker to take over accounts through improper input validation. CVE-2026-53412 affects Zoom Workplace for Windows before 7.0.0 and Zoom Workplace VDI Client for Windows before the applicable fixed versions.
• CVE-2026-53410 (CVSS 7.0): Allows an authenticated local attacker to escalate privileges through a Time-of-Check to Time-of-Use (TOCTOU) race condition in the installation or removal processes of multiple Zoom Windows products. Affected products include Zoom Workplace, VDI Client, VDI Plugin, Zoom Rooms, and Remote Control for Zoom Contact Center for Windows.

Greenbone’s OPENVAS ENTERPRISE FEED includes registry checks to identify installations of Zoom Workplace for Windows that are vulnerable to CVE-2026-53412 [1] or CVE-2026-53410[2].

Summary

Emerging cyber security risks in July 2026 show attackers exploiting high-impact flaws across enterprise platforms, perimeter devices, development tools, and widely used applications. Amid the so-called “vulnpocalypse“ pressure, security teams should maintain high visibility and increase patch cadence with a priority given to exposed systems. Defense-in-depth becomes critical when attackers gain initial access.

For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.

CVE-2026-18577 (CVSS 8.2, EPSS ≥ 71st pctl) and CVE-2026-18556 (CVSS 7.4, EPSS ≥ 19th pctl), published in early August, have both been added to CISA’s Known Exploited Vulnerabilities (KEV) list within days of their disclosure [1][2]. N-able has published Indicators of Compromise (IoC) and post-exploitation activity from successful attacks against its own hosted N-central instances. N-central version 2026.3.1 is required to remediate both CVEs.

CVE-2026-18577 is considered a bypass of the fix for CVE-2026-18556. Both are authentication bypass [CWE-288] flaws that allow admin-level account takeover and full-platform compromise of N-central servers. No public proof-of-concept (PoC) exploit code or detailed technical analysis has been published for CVE-2026-18556 or CVE-2026-18577. Several national CERT agencies have published alerts for the CVEs [1][2][3][4][5][6][7].

A Risk Assessment of CVE-2026-18577 and CVE-2026-18556 Affecting N-able N-central

CVE-2026-18577

CVSS 8.2 · HighEPSS 1.5% (71st)Actively exploitedIn CISA KEV

CVE-2026-18556

CVSS 7.4 · HighEPSS 0.3% (19th)Actively exploitedIn CISA KEV

On July 31st, 2026, N-able detected malicious activity targeting N-central server in a customer environment. Analysis led to the discovery of a zero-day vulnerability, which was initially assigned CVE-2026-18556. The flaw was remediated in N-central 2026.2, but the fix left an alternate authentication-bypass path. N-able assigned CVE-2026-18577 to track the incomplete fix separately. N-central 2026.3 Hotfix 1 was released on August 2nd, which fully remediates both CVEs.

CVE-2026-18577 and CVE-2026-18556 are high risk because of N-central’s role as a remote administration platform in Managed Service Provider (MSP) environments. N-central includes tooling such as Take Control, Remote Desktop, Extensible Messaging and Presence Protocol (XMPP) control channels, and SSH access, among other services.

As evidenced by N-able’s reports of post-exploitation activity, compromise of an N-central server creates broad downstream risk across managed customer environments. Defenders should treat the issue as a platform-wide operational risk rather than limited to a single component or attack surface.

Multiple sources report that roughly 3,000 N-central servers were exposed to the public internet in 2025 [1][2]. Shodan currently identifies approximately 2,300 instances. This recent incident is not the first time that N-central has come under active exploitation. In mid-2025, CVE-2025-8875 (CVSS 7.8) and CVE-2025-8876 (CVSS 8.8) were both added to CISA’s KEV list [3][4].

Technical Assessment and Attack Trajectory

CVE-2026-18577 (CVSS 8.2, EPSS ≥ 71st pctl) is the result of an incomplete patch for CVE-2026-18556 (CVSS 7.4, EPSS ≥ 19th pctl), which was published only one day before CVE-2026-18577. Both flaws are described as authentication bypass vulnerabilities [CWE-288] affecting N-central instances. Post-exploitation reporting indicates that they allow admin-level account takeover and full-platform compromise. The vendor-supplied evidence does not include root-cause details or identify specific exploitable components. No further technical analysis or PoC exploits have been published.

N-able has published indicators of compromise (IoC) and post-compromise details from successful attacks on its hosted N-central infrastructure. These include a rogue file named svchost.exe in the user’s Documents folder, a registered service named Cloudflared, and inbound connections from several IP addresses. For defenders, this means that the patches should be paired with a full forensic review of exposed systems and monitoring of network traffic for anomalous activity.

Observed post-compromise activity included:

• Gaining administrative access to vulnerable N-central servers [T1190]
• Using N-central’s Take Control function to access connected systems remotely [T1219.002]
• Installing a rogue service [T1543.003] named Cloudflared on managed endpoints for persistent remote access even after access through the N-central server was revoked

CVE-2026-18577 & CVE-2026-18556: Affected Versions and Mitigation

Defenders should be primarily concerned about CVE-2026-18577 since it is a bypass of an earlier flaw. CVE-2026-18577 affects all N-central instances prior to version 2026.3.1. N-able’s status page states that hosted N-central instances are upgraded automatically. However, self-hosted customers must apply the 2026.3 Hotfix 1, identified as build 2026.3.1.7.

N-able has published IoCs for its own incident response forensic analysis. The IoC information suggests that responders review potentially impacted systems for a file named svchost.exe in the user’s Documents folder, a registered service named Cloudflared, and inbound connections from several observed IP addresses.

Summary

N-able has issued N-central 2026.3 HF1 to mitigate CVE-2026-18577, which affects all previous versions of N-central. Because N-central is an administrative platform used by MSPs to manage customer environments, the operational risk is high. Known IoCs are available from the analysis of real-world breaches. Defenders should pair hotfix deployment with a full forensic review of potentially compromised systems.

Several concerning vulnerabilities affecting Linux have emerged in recent months. The vulnerabilities include CISA Known Exploited Vulnerabilities (KEV) entries for CVE-2026-31431 (aka Copy Fail) [1], and an older flaw, CVE-2022-0492 [2]. However, a wave of concerning new vulnerabilities are associated with publicly available exploits or proof-of-concept (PoC) code. Collectively, the flaws represent local privilege escalation, container escape, arbitrary command execution as root, kernel heap corruption, and remote code execution (RCE). Linux users should regularly scan their infrastructure, conduct assessments to determine exposure, and prioritize patching to reduce risks to critical assets.

A Risk Assessment of Emerging Linux Kernel Vulnerabilities

In recent weeks, the Greenbone blog reviewed Copy Fail, a new actively exploited Linux vulnerability, along with Copy Fail 2 and Dirty Frag. Since then, several new vulnerabilities affecting the Linux kernel and core components have emerged, presenting significant operational risk within the Linux ecosystem.

A Technical Assessment of Emerging Linux Vulnerabilities

The following section reviews recently disclosed vulnerabilities affecting the Linux kernel and core components. Each section summarizes the underlying technical cause, available threat intelligence, potential temporary mitigations, and the upstream fixes.

CVE-2026-31705 Affecting ksmbd SMB Server

CVSS 9.8 · CriticalEPSS 0.4% (32nd)No known exploitationPatch available

CVE-2026-31705 (CVSS 9.8, EPSS ≥ 32nd pctl) is an out-of-bounds write in the Linux kernel ksmbd SMB server’s smb2_get_ea() path. A memset operation for 4-byte alignment runs without checking the remaining space. Exploitation allows compound SMB requests to overwrite adjacent kernel heap memory.

A detailed technical write-up is available online, increasing the risk to defenders [1]. No vendor provided workarounds have been published. However, shutting down KSMBD and/or unloading and blocking the ksmbd kernel module can reasonably prevent attacks from reaching the affected components. Upstream fixes are incorporated into Linux kernel versions 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31705 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CVE-2026-55200 Affecting libssh2

CVSS 8.3 · HighEPSS 2.0% (79th)Public PoC

CVE-2026-55200 (CVSS 8.3, EPSS ≥ 79th pctl) affects libssh2. The flaw is an out-of-bounds write in ssh2_transport_read() caused by an unchecked attacker-controlled packet_length field. A malicious or compromised SSH server can send crafted SSH packets to trigger memory corruption and achieve RCE.

Detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2]. No workaround mitigation is available except for preventing libssh2 clients from connecting to untrusted SSH servers, such as disabling the service. CVE-2026-55200 affects all libssh2 versions up to and including 1.11.1. No fixed upstream release has yet been published, but the correction is available in upstream commit 97acf3df and has been backported by some Linux distributions. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-55200 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Fragnesia: CVE-2026-46300 (CVSS 7.5)

CVSS 7.8 · HighEPSS 2.5% (83rd)Public PoC

Dubbed Fragnesia, CVE-2026-46300 (CVSS 7.8, EPSS ≥ 83rd pctl) is caused by shared-fragment marker loss during skb coalescing in the Linux kernel’s net/skbuff and ESP input paths. Later in-place ESP processing allows decryption of page-cache-backed fragments. The issue is considered a trivial-to-exploit local privilege-escalation risk because it can corrupt page-cached read-only files. Ubuntu says exploitation can elevate a local user to root on affected hosts and that container-escape scenarios are also possible.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. Temporary mitigation can be achieved by unloading and blocking the esp4 and esp6 kernel modules [6]. CVE-2026-46300 affects Linux kernel versions 3.9 and later. Upstream fixes are incorporated into versions 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46300 and continues to add package-level checks as Linux distributions issue security advisories and patches.

ssh-keysign-pwn: CVE-2026-46333 (CVSS 7.1)

CVSS 7.1 · HighEPSS 1.5% (72nd)Public PoC

Dubbed ssh-keysign-pwn, CVE-2026-46333 (CVSS 7.1, EPSS ≥ 72nd pctl) is a race in Linux kernel ptrace and process-exit handling. The issue centers around dumpability and mm teardown. During a privileged process exit, pidfd_getfd() can duplicate open file descriptors from the dying process. Exploitation can expose sensitive root-owned material, including SSH keys and password hashes. The public proof-of-concept for this issue requires the pidfd_getfd syscall; a system call that can duplicate a file descriptor from another process. The kernel fix requires the CAP_SYS_PTRACE capability to inspect or control another process when the target process is exiting, known as the “no-mm” case.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5][6]. Temporary mitigation can be achieved by blocking all unprivileged users or only for users without the CAP_SYS_PTRACE privilege from attaching to other processes using the ptrace() system call [7]. CVE-2026-46333 is a Linux kernel vulnerability rather than an OpenSSH flaw. Patches are incorporated into Linux kernel versions 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.89, 6.18.31, 7.0.8, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46333 and continues to add package-level checks as Linux distributions issue security advisories and patches.

DirtyDecrypt / DirtyCBC: CVE-2026-31635 (CVSS 7.5)

CVSS 7.5 · HighEPSS 0.8% (53rd)Public PoC

Dubbed DirtyDecrypt (and DirtyCBC), CVE-2026-31635 (CVSS 7.5, EPSS ≥ 53rd pctl) affects Linux kernels with CONFIG_RXGK compiled in and enabled. An inverted bounds check in RxRPC / RxGK response validation allows oversized RESPONSE authenticators to be accepted and passed deeper into processing. Secondary reporting says the flaw can overwrite page-cached privileged files and be used for local privilege escalation to root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. No vendor provided workarounds have been published. However, independent researchers have suggested unloading and blocking the rxrpc module as a temporary solution [6]. Upstream fixes for CVE-2026-31635 are incorporated into Linux kernel versions 6.18.23, 6.19.13, and 7.0. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31635 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CIFSwitch: CVE-2026-46243 (CVSS 7.1)

CVSS 7.1 · HighEPSS 0.4% (30th)Public PoC

Dubbed CIFSwitch, CVE-2026-46243 (CVSS 7.1, EPSS ≥ 30th pctl) affects cifs_spnego handling in the Linux kernel’s CIFS client. The issue allows userspace to forge cifs.spnego key descriptions through request_key(2) or add_key(2), causing cifs.upcall to trust attacker-controlled authority fields. The flaw allows a low-privilege local user to trigger arbitrary command execution as root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. The temporary workaround is to unload and block the cifs kernel module, remove cifs-utils, or deactivate the cifs.spnego request-key rule [5]. CVE-2026-46243 affects Linux kernel with the CIFS client or cifs-utils, and the cifs.spnego request-key integration. Upstream fixes are incorporated into versions 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46243 and continues to add package-level checks as Linux distributions issue security advisories and patches.

PinTheft: CVE-2026-43494 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.3% (22nd)Public PoC

Dubbed PinTheft, CVE-2026-43494 (CVSS 7.8) affects the Linux kernel RDS zerocopy send path. The bug stems from cleanup logic that frees already released pages after op_nents is left nonzero. The exploit chain uses io_uring fixed buffers to overwrite the page cache of a SUID-root binary.

Several detailed write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. Workaround mitigation can be achieved by ensuring that the rds module is unloaded and blocked from automatic loading [5]. CVE-2026-43494 affects Linux kernel versions 4.17 and later with the RDS subsystem. Upstream fixes are incorporated into Linux kernel versions 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43494 and continues to add package-level checks as Linux distributions issue security advisories and patches.

GhostLock: CVE-2026-43499 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.7% (50th)Public PoC

Dubbed GhostLock, CVE-2026-43499 (CVSS 7.8) is a use-after-free in the Linux kernel rtmutex slowlock and proxy-lock rollback path. The remove_waiter() function leaves a dangling pointer and unsafe locking state. Red Hat and Ubuntu describe local privilege-escalation and denial-of-service impact [1][2], and Nebula says container escape is also possible on unpatched systems.

Several detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. No workaround mitigation is available. CVE-2026-43499 affects Linux kernel versions 2.6.39 and later with upstream fixes incorporated into versions 5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43499 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Mitigation for Emerging Linux Vulnerabilities

Organizations should prioritize patching for emerging Linux vulnerabilities based on the operational and business value of affected assets, the reachability of affected systems, each flaw’s technical details, and threat intelligence, including known active exploitation and the existence of PoC exploits.

Mitigating vulnerabilities found in the upstream Linux kernel depends on either implementing effective workarounds or installing updates in downstream Linux distributions when they become available. Where technical workarounds are not available, defenders must upgrade to fixed kernel builds.

Summary

Recent Linux kernel and core component vulnerabilities have exposed organizations to new risks. The potential impacts include local privilege escalation, container escape, arbitrary command execution, memory corruption, and RCE. Publicly available technical analyses and proof-of-concept exploits increase the urgency. When prioritizing patches, defenders must identify all affected systems and consider asset criticality, business risk, reachability, and exploitability.

Check Point has published three new security advisories addressing flaws in Security Management Server (SMS), Multi-Domain Management (MDM), and other Gaia-related components. The highest-priority issue, CVE-2026-16232 (CVSS 9.1), is an actively exploited authentication bypass affecting Check Point SmartConsole in SMS and MDM products. CVE-2026-16232 was published on July 22nd, 2026, and added to CISA’s Known Exploited Vulnerabilities (KEV) list the same day. The other newly disclosed flaws are CVE-2026-62144 (CVSS 9.1), an authentication bypass and privilege escalation in SMS and MDM, and CVE-2026-62145 (CVSS 7.5) affecting the GaiaOS WebUI management interface of Check Point’s Firewall, MDM, Multi-Domain Log Server.

A Risk Assessment of Check Point’s July 2026 Security Update

According to Check Point, exploitation of CVE-2026-16232 only affected a very small number of customers that exposed management servers directly to the internet without IP restrictions. The vulnerabilities are high risk because they affect administrative control paths used to configure security policies, objects, gateways, permissions, and monitoring.

Check Point’s Security Management Server (SMS) manages one security-management domain. SMS sits above the gateways in the control hierarchy stores, objects and policies, and distributes them to managed Security Gateways. Multi-Domain Management (MDM) is the large-scale alternative to a single Security Management Server. It provides isolated management environments for different customers, business units, regions, or security zones.

SmartConsole is the GUI used to connect to and manage SMS, and Security Management Servers manage Security Gateways and monitor security events. Gaia Portal is the web-based interface for Gaia OS, and Check Point says most system configuration tasks can be performed through it.

CVE-2026-16232: Actively Exploited SmartConsole Authentication Bypass

CVSS 9.1 · CriticalActively exploitedIn CISA KEV

An improper authentication vulnerability [CWE-287] in the Check Point SmartConsole login process of SMS and MDM products. CVE-2026-16232 allows a remote, unauthenticated attacker to obtain an application login token and use it to authenticate with full administrative privileges. Remote exploitation requires access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Successful exploitation allows the attacker to modify security policies and configurations.

Other CVEs From Check Point’s July 2026 Advisories

Check Point’s July 2026 security advisories also disclosed two additional CVEs:

Affected Products and Mitigation for Check Point Security Management and Gaia OS

The direct remediation path is to apply the appropriate Jumbo Hotfix for the affected component’s current version of Gaia OS. For Check Point SMS, the relevant fixes are R81.20 Jumbo Hotfix Take 158, R82 Jumbo Hotfix Take 118, and R82.10 Jumbo Hotfix Take 36. These hotfixes address the CVEs discussed above, as well as CVE-2026-31431 (CVSS 7.8, aka Copy Fail), CVE-2026-43284 (CVSS 8.8), CVE-2026-43500 (CVSS 7.8, aka Dirty Frag), CVE-2026-46300 (CVSS 7.8, aka Fragnesia), and more. Patch prioritization should focus on SMS and MDM deployments that are reachable from the internet and do not use Trusted Clients restrictions or IP restrictions.

Summary

Check Point issued three new security advisories in July 2026 that disclose two Critical vulnerabilities in Security Management Server and one High-severity Gaia Portal privilege-escalation flaw[1][2][3]. CVE-2026-16232 allows full administrative access on Security Management infrastructure and is known to be actively exploited.

A WordPress Core vulnerability chain, publicly nicknamed wp2shell, combines CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137 (CVSS 5.9) for pre-authentication remote code execution (RCE). The exploit chain affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. WordPress 6.8.x before 6.8.6 is affected by CVE-2026-60137 alone. Dozens of proof-of-concept (PoC) exploits have been published for the full exploit chain [1] as well as several detailed technical write ups. In-the-wild exploitation was first widely reported by cyber security firms. Finally both CVEs were added to CISA’s KEV list on July 21st, 2026 [2][3]. Numerous national CERT agencies have issued alerts globally [4][5][6][7][8][9][10][11][12][13][14][15][16][17]. Because WordPress has an estimated 500 million installations globally, wp2shell presents a high degree of risk.

Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4]. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.

A Global Risk Assessment of wp2shell Affecting WordPress Core

The exposure is significant because the flaws impact default installations of WordPress Core rather than optional extensions or configurations and allows an unauthenticated attacker to achieve RCE. Searchlight Cyber estimates that more than 500 million websites use WordPress. Additional risk signals include widespread reports of active exploitation and numerous public PoCs.

A Summary of Active wp2shell Exploitation Campaigns

Active exploitation of CVE-2026-60137 and CVE-2026-63030 is now widely reported by numerous cyber security firms and independent sensor operators. Patchstack first classified both vulnerabilities as actively exploited shortly after disclosure [1]. Wordfence recorded probing of the WordPress REST API on July 17th, 2026, followed by a clear SQL-injection attempt 13 minutes later [2]. Several other cyber security companies have also confirmed active exploitation [3][4].

The observed campaigns are opportunistic, targeting WordPress installations across all industries and geographic regions. However, the activity has not been attributed to established threat actors, and no victims have been publicly identified. Confirmed techniques include unauthorized administrator-account creation, malicious-plugin installation, persistent backdoors and web shells, user enumeration, and attempts to obtain database credentials, authentication keys, and other secrets from wp-config.php.

Technical Details for CVE-2026-60137 and CVE-2026-63030

Here are brief details for both vulnerabilities in the wp2shell exploit chain:

• CVE-2026-63030 (CVSS 9.8): The WordPress Core batch API allows multiple REST calls to be bundled into one request. CVE-2026-63030 is a batch endpoint route confusion issue [CWE-436] associated with /wp-json/batch/v1. The flaw is caused when failed batch sub-requests are not appended to the $matches array resulting in an index offset. The flaw allows an attacker to submit a malicious batch of requests that includes a flawed low-privilege request designed to create an array index offset, followed by a high-privilege request that will be executed without proper authorization. By exploiting CVE-2026-63030, an attacker can not only bypass authorization, but also bypass other WordPress internal checks such as request method, route, and validation schema.
• CVE-2026-60137 (CVSS 5.9): An SQL-injection flaw caused by improper sanitization [CWE-89] of the author_exclude parameter in WP_Query. WordPress’s posts handler maps the attacker-controlled author_exclude value to the WP_Query::author__not_in parameter, which is only sanitized if provided as an integer array. When facilitated by CVE-2026-63030, attackers can provide malformed request parameters including a string type author_exclude value. The unsanitized value is then injected into an SQL query, where it can execute malicious SQL code.

How the wp2shell Unauthenticated RCE Chain Works

wp2shell is described as an exploit chain that combines CVE-2026-60137 and CVE-2026-63030. In the first stage, CVE-2026-63030 is leveraged to create a REST API batch endpoint route confusion flaw [CWE-436] in WordPress Core to execute unauthenticated commands. In the second stage, that condition is combined with the SQL-injection flaw [CWE-89] tracked as CVE-2026-60137 to further impact target WordPress installations.

Here is a general description of the wp2shell attack flow:

1. Exploit CVE-2026-63030

• The attacker submits a malicious request to WordPress’s public /wp-json/batch/v1 endpoint. The malformed subrequest triggers a request handler mismatch allowing privileged requests to be executed without proper authorization.
• The attacker recursively invokes the vulnerable batch endpoint. An initial desynchronization exploit bypasses authorization, while a second desynchronization exploit bypasses parameter validation. This allows a normally unsupported GET request to reach the WordPress posts handler with unvalidated input.

2. Exploit CVE-2026-60137

• The posts handler maps the attacker-controlled author_exclude value to WP_Query::author__not_in. WordPress sanitizes this value when it is provided as an array but not when it arrives as a string, allowing the value to be injected directly into an SQL query. The attacker may use a blind or UNION SELECT SQL-injection attack to recover sensitive information that can be used for further exploitation. This information includes enumerating the WordPress table prefix, an administrator user ID, existing post IDs, and generated oEmbed-cache row IDs.
• A UNION SELECT SQL injection can be designed to create legitimate WP_Post objects which are stored in the WordPress object cache. These objects form a chain of legitimate WordPress behaviors that convert the read-oriented SQL injection into database writes and application control-flow changes. Exploitation can allow an attacker to create rogue posts with web shells to achieve RCE with the privileges of the web-server process.
• Other attack scenarios include creating persistent rogue administrator accounts and using them to upload malicious plugins, theme components, or web shells to achieve RCE with the privileges of the web-server process.

Affected Versions and Mitigation for wp2shell

CVE-2026-60137 affects WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. CVE-2026-63030 affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. WordPress 6.8.x is only vulnerable to CVE-2026-60137, not the full wp2shell chain. The full wp2shell unauthenticated RCE vulnerability is only reported for WordPress Core versions 6.9.x and 7.0.x. That distinction is relevant for risk-based remediation, since exploiting CVE-2026-60137 depends on vulnerability to CVE-2026-63030.

The only described mitigation is to update WordPress Core to a fixed release. Users should update affected systems to 6.8.6, 6.9.5, or 7.0.2 as applicable. Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4].

Summary

wp2shell is an unauthenticated RCE chain against WordPress Core that combines CVE-2026-63030 with CVE-2026-60137. Risk is amplified by widespread reports of exploitation. Defenders should immediately identify vulnerable WordPress installations and update them to the fixed versions described above.

Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4]. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.