The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Apple Patches Everything (July 2026)

Published: 2026-07-29

Last Updated: 2026-07-29 07:32:37 UTC

by Johannes Ullrich (Version: 1)

I am a bit late with this summary, but this week Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prior to macOS 26. macOS updates covered the two older versions (14 and 15), while other operating system patches only covered the current 26 versions.

A total of 187 vulnerabilities are addressed in this update. Many cover multiple operating systems. Apple did not label any of the vulnerabilities as already being exploited.

Three vulnerabilities that caught my interest are CVE-2026-28849, CVE-2026-28900, and CVE-2026-28914. These issues appear to be the vulnerability described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/ earlier this week. But I have not seen a confirmation that this is the same issue.

Other than that, the vulnerabilities are "more of the usual". A lot of DoS and privilege-escalation/sandbox-escape issues, and the usual WebKit issues. In June, Apple announced that it may publish occasional "security update only" releases. This release does not contain any significant new functionality but is also meant as a "prep release" for iOS/macOS 27, as it makes some adjustments to Spotlight to get the system ready for the new major OS releases coming in the fall.

Read the full entry: https://isc.sans.edu/diary/Apple+Patches+Everything+July+2026/33196/

AutoIT Payload Injector

Published: 2026-07-28

Last Updated: 2026-07-28 07:42:27 UTC

by Xavier Mertens (Version: 1)

For a long time, AutoIT has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you'll see below.

Since last week, I detected a wave of similar emails that deliver the same kind of payload. The example I'll cover started with a fake bank email containing a RAR archive ... . The archive contains a VBS script ...

This first script is pretty simple: it decodes a Base64 payload, dumps it on disk with a random name and invokes a PowerShell interpreter to decompress it (I beautified the script a bit) ...

Read the full entry: https://isc.sans.edu/diary/AutoIT+Payload+Injector/33192/

Scans for ESAFENET CDG 3 Document Management System Weak Logins

Published: 2026-07-26

Last Updated: 2026-07-26 15:26:14 UTC

by Johannes Ullrich (Version: 1)

ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public.

The scans we are seeing right now are going after the well-known default passwords that ESAFENET CDG ships with. Exploit scripts listing these passwords are, for example, included in a nulei template published in 2023 ...

Read the full entry: https://isc.sans.edu/diary/Scans+for+ESAFENET+CDG+3+Document+Management+System+Weak+Logins/33184/

Java Spring Boot "heapdump" scans (2026.07.27)

https://isc.sans.edu/diary/Java+Spring+Boot+heapdump+scans/33188/

When the "Autonomous Attacker" Is Your Own AI Model (2026.07.23)

https://isc.sans.edu/diary/When+the+Autonomous+Attacker+Is+Your+Own+AI+Model/33180/

Rondo Meets Geoserver (2026.07.22)

https://isc.sans.edu/diary/Rondo+Meets+Geoserver/33176/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-16232 - Check Point SmartConsole has an authentication bypass vulnerability that allows remote attackers to obtain an application login token and gain full administrative privileges, leading to the ability to modify security policies and configurations.

Product: Check Point SmartConsole

CVSS Score: 9.1

** KEV since 2026-07-22 **

ISC Podcast: https://isc.sans.edu/podcastdetail/10020

References:

- https://support.checkpoint.com/results/sk/sk185169

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232

CVE-2026-62144 - Check Point Security Management and Multi-Domain Security Management are vulnerable to an authentication bypass that enables remote attackers to execute administrative commands on the Management Server and managed Security Gateways.

Product: Check Point Security Management and Multi-Domain Security Management

CVSS Score: 9.1

References: https://support.checkpoint.com/results/sk/sk185152

CVE-2026-63030 - WordPress Core Interpretation Conflict Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-07-21 **

ISC Podcast: https://isc.sans.edu/podcastdetail/10016

References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030

CVE-2026-60137 - WordPress Core SQL Injection Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-07-21 **

ISC Podcast: https://isc.sans.edu/podcastdetail/10016

References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137

CVE-2021-27137 - DD-WRT Stack-Based Buffer Overflow Vulnerability

Product: DD-WRT

CVSS Score: 0

** KEV since 2026-07-21 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-27137

References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137

CVE-2026-16812 - VeloCloud Orchestrator (VCO) on-prem has a security issue that allows remote attackers to access privileged internal functionality, potentially compromising confidentiality, integrity, and availability of data managed by the orchestrator.

Product: VeloCloud Orchestrator (VCO)

CVSS Score: 0

** KEV since 2026-07-27 **

References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812

Oracle's July 2026 Critical Patch Update

On Tuesday, July 21, Oracle released its July 2026 Critical Patch Update which addresses 1,449 vulnerabilities across the company's product line. Affected products include JD Edwards EnterpriseOne; MySQL; Oracle Commerce; Oracle Communications; Oracle Database Server; Oracle Enterprise Manager; PeopleSoft Enterprise; and Fusion Middleware

- https://www.oracle.com/security-alerts/cpujul2026.html

- https://isc.sans.edu/podcastdetail/10020

Mozilla Updates Firefox and Thunderbird

On Tuesday, July 21, Mozilla released Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13 to address multiple vulnerabilities.

References:

- https://www.mozilla.org/security/advisories/mfsa2026-68/

- https://www.mozilla.org/security/advisories/mfsa2026-69/

- https://www.mozilla.org/security/advisories/mfsa2026-70/

- https://www.mozilla.org/security/advisories/mfsa2026-71/

- https://www.mozilla.org/security/advisories/mfsa2026-72/

CVE-2026-42990 - SQL Server ODBC driver Elevation of Privilege Vulnerability

Product: SQL Server

CVSS Score: 9.8

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990

CVE-2026-50447 - Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

Product: Windows Message Queuing Service

CVSS Score: 9.8

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50447

CVE-2026-56159 - DHCP Server Service Remote Code Execution Vulnerability

Product: DHCP Server

CVSS Score: 9.8

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56159

CVE-2025-66390 - Microsoft Azure API Management is vulnerable to cross-tenant requests due to a configuration issue allowing attackers to bypass signup restrictions.

Product: Microsoft Azure API Management

CVSS Score: 9.8

References:

- https://github.com/bountyyfi/Azure-APIM-Cross-Tenant-Signup-Bypass/security/advisories/GHSA-vcwf-73jp-r7mv

CVE-2026-42533 - NGINX Map directive and Regex matching vulnerability

Product: NGINX

CVSS Score: 8.1

ISC Podcast: https://isc.sans.edu/podcastdetail/10028

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42533

CVE-2026-6516 - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

Product: Zohocorp ManageEngine ADAudit Plus

CVSS Score: 10.0

References: https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html

CVE-2026-47668 - DbGate is vulnerable to remote code execution due to a code injection flaw in versions 7.1.8 and prior, which has been patched in version 7.1.9.

Product: DbGate JSON script runner

CVSS Score: 10.0

References: https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc

CVE-2026-64606, CVE-2026-64608, CVE-2026-64609 - Multiple vulnerabilities in Apache Fory

Product: Apache Fory

CVSS Scores: 9.1 - 9.8

References:

- https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc

- https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b

- https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b

CVE-2026-65008 - Grav 2.0.4 (fixed in 2.0.7) has a remote code execution vulnerability in Blueprint::dynamicData() allowing an authenticated account to execute malicious code via the form plugin.

Product: Grav 2.0.4

CVSS Score: 9.8

References:

- https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5

- https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata

- https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5

CVE-2026-28302, CVE-2026-28304 through CVE-2026-28310, CVE-2026-28312 through CVE-2026-28314, CVE-2026-28316, CVE-2026-28317, CVE-2026-28321 - Multiple vulnerabilities in SolarWinds Serv-U

Product: Solarwinds Serv-U

CVSS Score: 9.1

References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm

References:

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28304

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28305

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28306

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28307

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28308

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28309

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28310

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28312

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28314

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28316

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28317

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28321

CVE-2026-47391 through CVE-2026-47393, CVE-2026-47396, CVE-2026-47410, CVE-2026-47413, CVE-2026-47416 - Multiple vulnerabilities in PraisonAI

Product: PraisonAI

CVSS Scored: 9.6 - 9.9

References:

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4mr5-g6f9-cfrh

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8444-4fhq-fxpq

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3qg8-5g3r-79v5

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8g2p-pqm3-fcfh

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c2m8-4gcg-v22g

CVE-2026-65605, CVE-2026-65606 - Cross-site scripting vulnerabilities in SiYuan before v3.7.2.

Product: SiYuan

CVSS Score: 9.6

References:

- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh

- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728

CVE-2026-65687 through CVE-2026-65689 - Multiple vulnerabilities in Bold Reports Standalone Report Designer before version 14.1.12

Product: Bold Reports Standalone Report Designer

CVSS Score: 9.8

References:

- https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12

- https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-svg-processing

- https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-font-processing

- https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-database-download

CVE-2026-65057 - Keep (commit 91c75e0) is vulnerable to a server-side request forgery attack allowing unauthenticated attackers to manipulate the healthcheck endpoint and issue malicious HTTP requests.

Product: Keep (commit 91c75e0)

CVSS Score: 9.3

References: https://www.vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck

CVE-2026-65590 - n8n before 2.29.8 and 2.30.x before 2.30.1 lacks shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package, allowing unrestricted access to host filesystem and network.

Product: N8N

CVSS Score: 9.8

References: https://www.vulncheck.com/advisories/n8n-before-shell-sandbox-bypass-on-linux-windows

CVE-2026-40712, CVE-2026-46738 - Dell PowerProtect Data Manager prior to 20.2.0.0 is vulnerable to improper input validation in the REST API, allowing a high-privileged attacker with remote access to elevate privileges.

Product: Dell PowerProtect Data Manager

CVSS Score: 9.1

References:

- https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities

- https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities

CVE-2026-16624 - Cal.com OSS is vulnerable to unauthorized teamId injection in webhook creation, potentially enabling theft of booking data and video-call passwords via webhook delivery.

Product: Cal.com OSS

CVSS Score: 9.6

References: https://github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6

CVE-2026-13072 - MongoDB: Enabling compute mode on a standalone mongod instance can lead to memory corruption if externally sourced BSON data is not properly validated during aggregation pipeline processing.

Product: MongoDB

CVSS Score: 8.1

ISC Podcast: https://isc.sans.edu/podcastdetail/10026

References: https://jira.mongodb.org/browse/SERVER-128494

CVE-2026-64812, CVE-2026-64813, CVE-2026-65907 - Multiple JetBrains vulnerabilities

Product: Jetbrains

CVSS Scores: 9.1 - 10.0

References: https://www.jetbrains.com/privacy-security/issues-fixed/

CVE-2026-28849 - macOS Sequoia and Sonoma versions prior to 15.7.8 and 14.8.8, respectively, are vulnerable to a Gatekeeper bypass when processing maliciously crafted ZIP archives.

Product: Apple macOS

CVSS Score: 0

ISC Diary: https://isc.sans.edu/diary/33196 ISC Podcast: https://isc.sans.edu/podcastdetail/10028

References:

- https://support.apple.com/en-us/128071

- https://support.apple.com/en-us/128072

CVE-2026-28900 - macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 fixed a file quarantine bypass vulnerability involving maliciously crafted ZIP archives.

Product: Apple macOS

CVSS Score: 0

ISC Diary: https://isc.sans.edu/diary/33196 ISC Podcast: https://isc.sans.edu/podcastdetail/10028

References:

- https://support.apple.com/en-us/128071

- https://support.apple.com/en-us/128072

CVE-2026-28914 - macOS Tahoe 26.5 fixed a logic issue with improved file handling, but a maliciously crafted ZIP archive may still bypass Gatekeeper checks.

Product: Apple macOS

CVSS Score: 0

ISC Diary: https://isc.sans.edu/diary/33196 ISC Podcast: https://isc.sans.edu/podcastdetail/10028

References:

- https://support.apple.com/en-us/128071

- https://support.apple.com/en-us/128072

- https://support.apple.com/en-us/127115

CVE-2025-43325 - An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. Affects icons. Product: Apple macOS CVSS Score: 5.5 ISC Diary: https://isc.sans.edu/diary/33196 ISC Podcast: https://isc.sans.edu/podcastdetail/10028 References:

- https://support.apple.com/en-us/125110

- https://seclists.org/fulldisclosure/2025/Sep/53

CVE-2026-64878, CVE-2026-64879 - Command injection vulnerabilities in Tenable Security Center

Product: Tenable Security Center

CVSS Score: 9.9

References: https://www.tenable.com/security/tns-2026-19

CVE-2026-64319 - nvmet-auth: validate reply message payload bounds against transfer length

Product: Linux kernel

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64319

NO CUSTOMER ACTION REQUIRED TO ADDRESS THE FOLLOWING CVEs:

CVE-2026-56163 - Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Product: Microsoft Azure Kubernetes Service

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56163

CVE-2026-56165 - Microsoft Account Remote Code Execution Vulnerability

Product: Microsoft Account

CVSS Score: 9.8

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165

CVE-2026-54120 - Microsoft Surface Remote Code Execution Vulnerability

Product: Microsoft Surface

CVSS Score: 9.9

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54120

CVE-2026-50517 - Microsoft M365 Copilot Remote Code Execution Vulnerability

Product: Microsoft M365 Copilot

CVSS Score: 9.9

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50517

CVE-2026-56191 - Microsoft Exchange Online Tampering Vulnerability

Product: Microsoft Exchange Online

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56191

CVE-2026-57106 - Data Quality Elevation of Privilege Vulnerability

Product: Nozomi Networks SCADAguardian

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57106

CVE-2026-62825 - Azure Key Vault Elevation of Privilege Vulnerability

Product: Azure Key Vault

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62825

CVE-2026-58630 - Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability

Product: Microsoft Azure App Service on Azure Stack Hub

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58630

CVE-2026-58275 - Azure DNS Elevation of Privilege Vulnerability

Product: Microsoft Azure DNS

CVSS Score: 10.0

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58275

CVE-2026-62835 - Azure Portal Information Disclosure Vulnerability

Product: Azure Portal

CVSS Score: 9.3

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62835