July 2026 CVE Landscape

What Happened

In July 2026, researchers identified 85 serious security flaws in widely used software and devices, a 44% increase from the previous month. More than half of these flaws allow attackers to remotely run code on affected systems, and public exploit code was available for most of them. Attackers targeted a wide range of systems including internet routers and cameras (to build botnets), email platforms (to steal information), and enterprise software like Microsoft Exchange and SharePoint. Several of the exploited flaws are years old, showing that many organizations still have not applied available fixes. Organizations should review the full vulnerability list, prioritize patching based on exploit likelihood (not just severity scores), and pay special attention to any internet-facing devices or email systems in their environment.

Key Takeaways

• 85 high-impact vulnerabilities identified in July 2026, a 44% increase from the prior month, with 36 rated Very Critical (Risk Score 99).
• 57 of the 85 vulnerabilities enabled remote code execution (RCE), affecting Microsoft, Fortinet, Langflow, ServiceNow, WordPress, Joomla, and IoT/embedded devices.
• Public proof-of-concept exploits were available for 60 of the 85 vulnerabilities, and the fastest observed disclosure-to-exploitation window was less than one day.
• The Dysphoria botnet and China-nexus UAT-7810 actor exploited legacy IoT/router CVEs to build DDoS and relay infrastructure (LapDogs ORB network).
• Email and collaboration platforms were targeted for espionage: Cloud Atlas exploited CVE-2018-0802, UNK_MassTraction exploited Roundcube CVEs, and TA488 exploited Exchange CVE-2026-42897 to deploy OWAReaper.

Affected Systems

• Microsoft Office Equation Editor
• Microsoft SharePoint Server
• Microsoft Exchange Server 2016 CU23 and Subscription Edition RTM
• Microsoft Active Directory Federation Services
• Microsoft Windows
• Fortinet FortiOS
• Fortinet FortiSandbox
• Langflow
• SonicWall SMA1000 Appliances
• Cisco IOS
• Cisco Secure Firewall Management Center (FMC)
• ServiceNow AI Platform
• WordPress Core
• Roundcube Webmail
• Zimbra Collaboration
• Various IoT devices (Huawei HG532, Linksys routers, Tenda routers, TOTOLINK routers, Ruckus APs, DVRs, Wi-Fi repeaters)
• Adobe ColdFusion
• Apache Tomcat
• Palo Alto Networks PAN-OS and Prisma Access
• NetScaler ADC and Gateway
• Oracle E-Business Suite
• Check Point SmartConsole
• Craft CMS
• Alibaba Nacos
• Alibaba Fastjson

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Threat actors exploit public-facing vulnerabilities (e.g., CVE-2017-17215 in Huawei HG532, CVE-2024-42009 in Roundcube, CVE-2026-42897 in Exchange) or use malicious documents/shortcuts for client-side exploitation (CVE-2018-0802, CVE-2025-9491)
2. Execution: Malicious Office documents deliver CloudAtlasGo; obfuscated PowerShell deploys BusySnake Stealer; IceCube used post-exploitation via Roundcube compromise
3. Persistence and Relay: Compromised IoT devices enrolled into Dysphoria DDoS/relay infrastructure or LapDogs ORB network (UAT-7810) using weak Telnet/SSH credentials
4. Lateral Movement and Collection: Email/collaboration platform access used for espionage and sensitive information theft
5. Impact: Data theft, extortion, and encryption of exposed AI and product-lifecycle platforms by JADEPUFFER and Cl0p

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Nuclei templates (Recorded Future Intelligence Platform)

Insikt Group created a Nuclei template to detect CVE-2025-3248 (Langflow), available to Recorded Future customers via the Intelligence Platform. No YARA, Sigma, Snort, or Suricata rules are provided in the article.

Detection Engineering Assessment

Required Log Sources

• Web application firewall logs
• Network appliance syslog
• Email gateway logs
• EDR process execution logs
• DNS resolution logs
• CISA KEV catalog feed

Hunting Hypotheses

Control Gaps

• IoT and embedded devices (routers, cameras, DVRs) typically lack endpoint detection capabilities, creating blind spots for Dysphoria and UAT-7810 compromise detection
• Network appliances running FortiOS, SonicWall, NetScaler, and PAN-OS may not generate logs compatible with standard SIEM ingestion without additional configuration
• Legacy vulnerabilities (5-18 years old) may persist in environments where asset inventory is incomplete or patching is deprioritized for older systems
• Public PoC availability for 60 of 85 vulnerabilities reduces the barrier to exploitation, potentially overwhelming signature-based detection

Key Behavioral Indicators

• Obfuscated PowerShell execution spawned from a Windows shortcut (.lnk) file
• Unusual outbound proxy or relay traffic from IoT/embedded devices
• Exploitation attempts targeting Equation Editor (CVE-2018-0802) in Office documents
• Anomalous authentication or session activity on Roundcube, Zimbra, or Exchange webmail interfaces
• Unexpected file uploads or code injection attempts against web applications (CWE-434, CWE-94 patterns)
• Deserialization exploitation attempts against Java-based applications (Fastjson, Apache Tomcat, ColdFusion)

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether internet-facing security appliances (Fortinet, SonicWall, Palo Alto, NetScaler, Cisco FMC) are running current firmware versions, and consider restricting management interfaces to internal networks or VPN-only access where supported.
• Consider disabling or restricting Telnet on all IoT and network devices, as the Dysphoria botnet combined weak Telnet/SSH credentials with known RCE flaws for compromise.
• If applicable, consider deploying WAF rules or virtual patching for web application vulnerabilities (WordPress, Joomla, Craft CMS, Adobe ColdFusion) where immediate patching is not feasible.
• Evaluate whether your email platform (Roundcube, Zimbra, Exchange) has adequate logging and alerting for anomalous session activity or exploitation attempts.

User Protection

• Consider enabling enhanced exploit protection for Microsoft Office (e.g., disabling Equation Editor) if not already configured, given Cloud Atlas's active exploitation of CVE-2018-0802.
• If your EDR supports it, consider enabling detection rules for obfuscated PowerShell execution originating from shortcut files, consistent with Armored Likho TTPs.
• Consider reviewing email security controls to detect malicious attachments and links targeting collaboration platforms, especially if Roundcube or Zimbra are in use.

Security Awareness

• Consider incorporating guidance on the risks of unpatched legacy systems into existing awareness programs, emphasizing that 14 of the 85 exploited vulnerabilities are at least 5 years old.
• Where applicable, remind users to report suspicious emails and unexpected Office document attachments, as threat actors continue to target document workflows for initial access.
• Consider briefing IT and network teams on the active targeting of IoT and edge devices by botnets, and the importance of changing default credentials on all network equipment.

MITRE ATT&CK Mapping

Additional IOCs

• Command Lines:
  • Purpose: Execution of obfuscated PowerShell via malicious Windows shortcut to deploy BusySnake Stealer | Tools: powershell.exe, Windows Shortcut (.lnk) | Stage: Execution | powershell.exe -e