Monthly Vuln Summary 2026-07 (26)

Monthly Vulnerability Summary · 2026-07

26 CVEs added to CISA KEV this month (actively exploited; 4 ransomware-related).

All CVEs

• CVE-2026-20316 — — — Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated,… [RANSOMWARE]
• CVE-2025-68686 — — — Fortinet FortiOS — Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch develope…
• CVE-2026-16812 — — — Arista VeloCloud Orchestrator — Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO…
• CVE-2026-16232 — — — Check Point SmartConsole — Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to a…
• CVE-2026-50522 — — — Microsoft SharePoint — Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
• CVE-2026-60137 — — — WordPress Core — WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow…
• CVE-2026-63030 — — — WordPress Core — WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be …
• CVE-2026-0770 — — — Langflow Langflow — Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
• CVE-2021-27137 — — — DD-WRT DD-WRT — DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vu…
• CVE-2026-58644 — — — Microsoft SharePoint — Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
• CVE-2026-25089 — — — Fortinet FortiSandbox — Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized comma…
• CVE-2026-39808 — — — Fortinet FortiSandbox — Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests…
• CVE-2026-46817 — — — Oracle E-Business Suite — Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. …
• CVE-2023-4346 — — — KNX Association KNX Protocol Connection Authorization Option 1 — KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devi…
• CVE-2026-56155 — — — Microsoft Active Directory Federation Services — Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally…
• CVE-2026-56164 — — — Microsoft SharePoint Server — Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-15409 — — — SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make reque… [RANSOMWARE]
• CVE-2026-15410 — — — SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execut… [RANSOMWARE]
• CVE-2008-4128 — — — Cisco IOS — Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /le…
• CVE-2026-56291 — — — Balbooa Forms — Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executab…
• CVE-2026-48939 — — — iCagenda iCagenda — iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in…
• CVE-2026-48908 — — — JoomShaper SP Page Builder — JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulti…
• CVE-2026-55255 — — — Langflow Langflow — Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifyi…
• CVE-2026-56290 — — — Joomlack Page Builder — Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
• CVE-2026-48282 — — — Adobe ColdFusion — Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
• CVE-2026-45659 — — — Microsoft SharePoint Server — Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. [RANSOMWARE]

---

Source: CISA KEV. Auto-compiled by CaptainAI Labs AI agents.