10 minhigh
Cyber Centre Daily Advisory Digest — 2026-07-16 (7 advisories)
The Canadian Centre for Cyber Security published 7 security advisories on July 16, 2026, covering Zoom, Splunk, JetBrains, Grafana, Microsoft, and Fortinet products. The most critical items are three Microsoft CVEs (CVE-2026-56164, CVE-2026-56155, CVE-2026-58644) and three Fortinet FortiSandbox CVEs (CVE-2026-25089, CVE-2026-39813, CVE-2026-39808) that have been confirmed as actively exploited and added to CISA's Known Exploited Vulnerabilities database. Splunk Enterprise also has critical vulnerabilities including a CSRF-based SPL command bypass and a path traversal in the App Install REST endpoint.
Sens:■ ImmediateConf:
Detection / Hunteropenrouter
What Happened
The Canadian government's cyber security agency published seven security advisories on July 16, 2026, warning about vulnerabilities in widely used software from Zoom, Splunk, JetBrains, Grafana, Microsoft, and Fortinet. The most urgent warnings concern Microsoft and Fortinet products, where multiple vulnerabilities are already being actively exploited by attackers in the wild — meaning criminals or spies are already using these flaws to break into systems. Organizations using any of these products should immediately check which versions they have installed and apply the available security updates as soon as possible, prioritizing the Microsoft and Fortinet patches since those vulnerabilities are being actively exploited.
Key Takeaways
- Microsoft July 2026 Patch Tuesday includes CVE-2026-56164, CVE-2026-56155, and CVE-2026-58644, all added to CISA's KEV database with active exploitation confirmed for the first two.
- Fortinet FortiSandbox is affected by multiple exploited vulnerabilities including CVE-2026-25089 (OS command injection via JSON input on VNC feature), CVE-2026-39813, and CVE-2026-39808 (added to KEV), spanning advisories AV26-568 and AV26-351.
- Splunk Enterprise has critical vulnerabilities including a CSRF-based SPL command safeguards bypass in Deployment Server and a path traversal via 'explicit_appname' in the App Install REST endpoint.
- Grafana MCP Server is vulnerable to SSRF via the X-Grafana-URL header, and Grafana Loki has an unbounded memory allocation issue in detected_fields query limits.
- Zoom, JetBrains, and multiple Microsoft products (Exchange Server, Office, SQL Server, Windows, .NET, Visual Studio, Surface) all received security updates requiring immediate patching.
Affected Systems
- Zoom Remote Control for Zoom Contact Center for Windows (prior to 7.0.0)
- Zoom Meeting SDK for Windows (prior to 6.6.11)
- Zoom Rooms for Windows (prior to 7.1.0)
- Zoom Workplace for Windows (prior to 7.0.5)
- Zoom Workplace VDI Client for Windows (prior to 7.0.10, 6.5.18, 6.6.15, 6.5.17, 6.6.14)
- Splunk Enterprise (multiple versions and platforms)
- Splunk Cloud Platform (multiple versions and platforms)
- JetBrains TeamCity (prior to 2026.1.2)
- JetBrains YouTrack (multiple versions)
- JetBrains IntelliJ IDEA (prior to 2026.1.4 and 2026.2)
- Grafana MCP Server (0.17.1 and prior)
- Grafana Loki (3.7.0 and prior)
- Microsoft Windows 10, 11, Server 2012/2012 R2/2016/2019/2022/2025
- Microsoft Exchange Server 2016, 2019, Subscription Edition RTM
- Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024
- Microsoft SQL Server 2016, 2017, 2019, 2022, 2025
- Microsoft .NET Framework, .NET 8.0/9.0/10.0 on Linux/Mac/Windows
- Microsoft Visual Studio 2022, 2026, Visual Studio Code
- Microsoft 365 Apps, Copilot, Defender for Endpoint for Mac
- Microsoft Edge (Chromium-based)
- FortiSandbox 4.4 (4.4.0 to 4.4.8)
- FortiSandbox 5.0 (5.0.0 to 5.0.5)
- FortiSandbox Cloud 5.0 (5.0.4 to 5.0.5)
- FortiSandbox PaaS 5.0 (5.0.4 to 5.0.5)
- FortiAnalyzer Cloud 7.6 (7.6.2 to 7.6.4)
- FortiManager Cloud 7.6 (7.6.2 to 7.6.4)
- FortiDDoS-F 7.2 (7.2.1 to 7.2.2)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-56164 | Microsoft products (specific product not stated in advisory) | Exploited vulnerability in Microsoft July 2026 Patch Tuesday; added to CISA KEV database. | |
| CVE-2026-56155 | Microsoft products (specific product not stated in advisory) | Exploited vulnerability in Microsoft July 2026 Patch Tuesday; added to CISA KEV database. | |
| CVE-2026-58644 | Microsoft products (specific product not stated in advisory) | Vulnerability in Microsoft July 2026 Patch Tuesday; added to CISA KEV database on July 16, 2026. | |
| CVE-2026-25089 | FortiSandbox 4.4/5.0/Cloud/PaaS | Second-order OS command injection via JSON input on the start VNC feature; actively exploited and added to CISA KEV. | |
| CVE-2026-39813 | FortiSandbox 4.4/5.0 | Vulnerability in FortiSandbox; open-source reporting indicates active exploitation. | |
| CVE-2026-39808 | FortiSandbox 4.4/5.0 | Unauthenticated authentication bypass and privilege escalation in FortiSandbox; actively exploited and added to CISA KEV. |
Attack Chain
- Initial Access: Attackers exploit publicly exposed FortiSandbox instances via CVE-2026-39808 (unauthenticated auth bypass) or CVE-2026-25089 (OS command injection via VNC JSON input)
- Privilege Escalation: Auth bypass vulnerability in FortiSandbox enables privilege escalation to gain elevated access
- Execution: OS command injection allows arbitrary command execution on FortiSandbox devices
- Exploitation: Separately, attackers exploit Microsoft CVE-2026-56164 and CVE-2026-56155 in targeted attacks against unpatched Windows/Microsoft environments
- Persistence/Lateral Movement: Attackers leverage initial footholds from exploited vulnerabilities for further network compromise
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in this advisory digest. Defenders should consult vendor-specific security bulletins (Microsoft Security Update Guide, Fortinet PSIRT Advisories, Splunk Security Advisories, Grafana Blog) for patch details and any vendor-provided detection guidance.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect post-exploitation activity such as suspicious command execution following OS command injection on FortiSandbox or exploitation of Microsoft vulnerabilities, but the initial exploitation of network-facing vulnerabilities may occur before EDR visibility is available. |
| Network Visibility | Medium | Network monitoring may detect anomalous traffic to FortiSandbox API endpoints, VNC-related JSON input patterns, or SSRF attempts via X-Grafana-URL headers, but encrypted channels may limit visibility. |
| Detection Difficulty | Moderate | Patching is the primary remediation. Detecting exploitation of these vulnerabilities requires visibility into API endpoint access, VNC feature usage, and command injection patterns on FortiSandbox, plus Microsoft exploit telemetry that may be vendor-dependent. |
Required Log Sources
- FortiSandbox API access logs
- FortiSandbox VNC session logs
- Microsoft Exchange/IIS logs
- Windows Security Event Logs (4688 process creation, 4624 logon events)
- Splunk deployment server logs
- Splunk REST API access logs
- Grafana HTTP request logs
- Web application firewall (WAF) logs
- Network flow data for anomalous connections to FortiSandbox
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous API calls to FortiSandbox endpoints that may indicate exploitation of CVE-2026-39808 authentication bypass, focusing on unauthenticated requests that succeed without proper credentials. | FortiSandbox API access logs, authentication logs, WAF logs | Initial Access | Medium — legitimate administrative API access may generate similar patterns; correlate with known admin activity. |
| Consider hunting for JSON input containing VNC-related commands sent to FortiSandbox that may indicate exploitation of CVE-2026-25089 OS command injection via the start VNC feature. | FortiSandbox VNC session logs, API request logs, network flow data | Execution | Low to Medium — VNC start commands via JSON are relatively uncommon and can be correlated with authorized administrative sessions. |
| If you have visibility into Microsoft exploit telemetry, consider hunting for indicators of exploitation of CVE-2026-56164 and CVE-2026-56155 on unpatched Windows systems, focusing on anomalous process behavior following potential exploitation. | Windows Security Event Logs, EDR process telemetry, Microsoft Defender alerts | Initial Access | Medium — without specific exploit details, behavioral hunting may produce false positives; prioritize systems missing July 2026 patches. |
| Consider hunting for HTTP requests to Grafana MCP Server containing manipulated X-Grafana-URL headers that may indicate SSRF exploitation attempts. | Grafana HTTP access logs, reverse proxy logs, WAF logs | Initial Access | Low — X-Grafana-URL header manipulation is unusual in normal usage patterns. |
| Consider hunting for path traversal patterns in Splunk App Install REST API requests containing 'explicit_appname' parameters that may indicate exploitation of the path traversal vulnerability. | Splunk REST API access logs, Splunk audit logs, WAF logs | Initial Access | Low — path traversal sequences in app installation API calls are highly suspicious. |
Control Gaps
- Network-based IDS/IPS may not detect exploitation of FortiSandbox API vulnerabilities if traffic is encrypted or uses legitimate API paths
- WAF rules may not cover FortiSandbox-specific API endpoint exploitation patterns
- EDR coverage on FortiSandbox appliances may be limited or non-existent, reducing post-exploitation detection capability
- Patch management gaps for Microsoft July 2026 updates leave systems vulnerable to actively exploited CVEs
Key Behavioral Indicators
- Unauthenticated API requests succeeding against FortiSandbox endpoints (CVE-2026-39808)
- VNC session initiation via JSON API input on FortiSandbox (CVE-2026-25089)
- Anomalous X-Grafana-URL header values in HTTP requests to Grafana MCP Server
- Path traversal sequences in Splunk App Install REST API 'explicit_appname' parameter
- Unexpected process execution on systems missing Microsoft July 2026 security updates
- CSRF-based SPL command execution patterns in Splunk Deployment Server logs
False Positive Assessment
Low — the advisory digest references specific CVEs confirmed as exploited and added to CISA KEV. Detection efforts should focus on patching and monitoring for exploitation of these specific vulnerabilities rather than broad behavioral hunting.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching Microsoft products with July 2026 updates, especially on internet-facing systems, given CVE-2026-56164, CVE-2026-56155, and CVE-2026-58644 are actively exploited and in CISA KEV.
- Consider immediately patching FortiSandbox 4.4 and 5.0 (including Cloud and PaaS variants) to address CVE-2026-25089, CVE-2026-39813, and CVE-2026-39808, all of which are actively exploited.
- If patching cannot be performed immediately, consider restricting network access to FortiSandbox management interfaces and API endpoints to trusted IP ranges only.
- Consider applying Splunk Enterprise updates to address the CSRF-based SPL command bypass and path traversal vulnerabilities in the Deployment Server and App Install REST endpoint.
- Evaluate whether temporary disabling of the FortiSandbox VNC feature is feasible until patches can be applied.
Infrastructure Hardening
- Consider implementing network segmentation to isolate FortiSandbox appliances from general network access, limiting API and management interface exposure.
- Evaluate whether WAF rules can be configured to detect and block path traversal patterns in Splunk REST API requests and SSRF attempts via Grafana X-Grafana-URL headers.
- Consider enforcing strict authentication and access controls on all Splunk REST API endpoints and Grafana MCP Server instances.
- Review and verify that all internet-facing Microsoft Exchange Server and SharePoint Server instances have received July 2026 security updates.
User Protection
- Consider prioritizing patch deployment for Zoom Workplace, Zoom Rooms, and Zoom VDI Client on Windows endpoints to address improper input validation and privilege management vulnerabilities.
- Evaluate whether JetBrains TeamCity, YouTrack, and IntelliJ IDEA installations in your environment are updated to the latest versions (2026.1.2+ for TeamCity, 2026.1.4+/2026.2 for IntelliJ IDEA).
- Consider deploying Microsoft July 2026 patches to all Windows 10/11 endpoints and servers, with priority on systems exposed to the internet.
Security Awareness
- Consider communicating to IT and system administration teams the urgency of the FortiSandbox and Microsoft patches given active exploitation in the wild.
- If applicable, consider reminding development teams about the importance of promptly applying Splunk and JetBrains security updates in their CI/CD and development infrastructure.
- Consider reviewing existing vulnerability management SLAs to verify they accommodate the urgency of CISA KEV-listed vulnerabilities.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Discovery
Tactic
