VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence that they are being actively exploited. The vulnerabilities include two related to Fortinet's FortiSandbox, identified as CVE-2026-25089 and CVE-2026-39808, both of which are OS command injection flaws. The third vulnerability, CVE-2026-58644, affects Microsoft SharePoint and involves the deserialization of untrusted data. These vulnerabilities present serious risks, especially to federal agencies, which are urged to prioritize their remediation as mandated by CISA’s Binding Operational Directive 26-04. While this directive applies specifically to federal civilian agencies, CISA encourages all organizations to adopt similar practices for managing vulnerabilities. Organizations are also invited to report any exploited vulnerabilities not currently listed in the KEV Catalog.

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies address a serious vulnerability in the Oracle E-Business Suite by Saturday. This flaw is being actively exploited in the wild, posing risks to financial operations managed through the software. Agencies are urged to take immediate action to protect their systems from potential attacks that could compromise sensitive financial data. The urgency of this directive reflects the critical nature of the vulnerability and the potential impact on government operations if left unaddressed.

Splunk and Zoom have recently patched critical vulnerabilities in their software that could enable attackers to gain unauthorized access to user credentials and data. These flaws could allow malicious actors to take over accounts and escalate their privileges within the affected systems. Users of both platforms should take this update seriously, as the potential for exploitation poses significant security risks. The vulnerabilities were identified in the software's earlier versions, so it is crucial for users to update to the latest versions to protect their information. Prompt action can help prevent unauthorized access and maintain the integrity of user accounts.

Trend Micro, Tanium, ESET, and Tenable have released patches to address several severe vulnerabilities in their cybersecurity products. These vulnerabilities, classified as critical and high-severity, could potentially allow attackers to exploit systems running these affected products. Users of these software solutions should prioritize applying the updates to protect against possible intrusions. The timely patching is crucial as it helps prevent attackers from taking advantage of these security flaws. Organizations using these products should ensure their systems are updated to the latest versions to maintain security.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about three vulnerabilities in SharePoint Server that are currently being exploited by attackers. Federal agencies have until July 17 to apply patches to mitigate the risks associated with these flaws. The vulnerabilities could allow unauthorized access and manipulation of sensitive data, posing a significant threat to organizations using these systems. It's crucial for users of SharePoint Server to take immediate action to protect their environments from potential breaches. Ignoring these vulnerabilities could lead to serious security incidents and data loss.

A recently discovered vulnerability in Cursor allows attackers to execute arbitrary code on users' systems without their consent. By creating a malicious repository containing a 'git.exe' file in the project root, attackers can exploit this flaw, which Cursor executes automatically when the repository is accessed. This puts users at significant risk, especially those who frequently interact with repositories from untrusted sources or do not have adequate security measures in place. As there is currently no patch available to fix this issue, users should be cautious when using Cursor and consider limiting their exposure to potentially harmful repositories. This vulnerability serves as a reminder of the importance of maintaining security hygiene in software development environments.

The Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to quickly address three vulnerabilities in SharePoint that are currently being exploited by attackers. Among these, two have been identified as zero-days, meaning they are actively targeted before a patch was made available. This situation poses significant risks to users of SharePoint, as attackers could gain unauthorized access to sensitive data or disrupt operations. Organizations that use SharePoint are advised to prioritize patching these vulnerabilities to protect their systems and data from potential breaches. Immediate action is crucial to mitigate the risks associated with these exploits.

A newly discovered vulnerability, dubbed the '2-Click Cursor Exploit,' allows attackers to gain unauthorized access to developers' environments, potentially exposing sensitive secrets and source code. This exploit takes advantage of simple bugs that have been around for a long time, making it particularly concerning for organizations that rely on secure development practices. Developers using certain software tools could be at risk, as the exploit can lead to a complete takeover of their development environments. The implications are significant, as compromised environments can result in the theft of intellectual property and sensitive data. Companies are urged to review their security protocols and patch any vulnerabilities in their development tools as soon as possible.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The first, CVE-2023-4346, affects the KNX Protocol Connection Authorization Option 1, which has an overly restrictive account lockout mechanism, making it a target for attackers. The second, CVE-2026-46817, involves improper privilege management in Oracle E-Business Suite. These vulnerabilities pose significant risks, particularly to federal agencies, which are required by CISA's Binding Operational Directive 26-04 to prioritize rapid remediation of high-risk vulnerabilities. While this directive specifically applies to federal agencies, CISA encourages all organizations to adopt similar practices. Organizations that identify exploited vulnerabilities not listed in the KEV Catalog can submit them for potential inclusion.

Fortinet, Ivanti, and ServiceNow have all issued important patches for various vulnerabilities in their products. A notable issue was found in the ServiceNow AI platform, where a critical security flaw could allow remote attackers to execute arbitrary code. This vulnerability poses a significant risk to users, as it could enable unauthorized access and control over affected systems. Organizations using the ServiceNow platform should act quickly to apply the available updates to protect against potential exploitation. The situation serves as a reminder for companies to regularly update their software to mitigate risks from such vulnerabilities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding three vulnerabilities in on-premises SharePoint Server that are currently being exploited by attackers. These flaws affect SharePoint instances that are accessible via the internet, putting organizations at risk of unauthorized access and data breaches. Administrators are urged to take immediate action to protect their systems, as the vulnerabilities allow attackers to execute malicious commands and potentially compromise sensitive information. This situation is particularly concerning for businesses and government agencies that rely on SharePoint for collaboration and document management. Promptly applying available patches is essential to mitigate these risks and safeguard against ongoing exploitation.

Siemens, Schneider Electric, and Rockwell Automation have addressed numerous vulnerabilities in their industrial control system (ICS) products. These fixes come as part of the latest ICS Patch Tuesday updates, which also prompted advisories from the Cybersecurity and Infrastructure Security Agency (CISA) and VDE CERT. The vulnerabilities could potentially expose systems to various cyber threats, affecting critical infrastructure and manufacturing sectors. Companies using these ICS products need to ensure they apply the latest patches to mitigate any risks associated with these vulnerabilities. This update is crucial for maintaining the security and integrity of industrial operations.

SonicWall has issued a warning about two vulnerabilities in its SMA1000 series, identified as CVE-2026-15409 and CVE-2026-15410. These flaws are being actively exploited by attackers in zero-day attacks, meaning they are being targeted before a fix has been widely implemented. As such, SonicWall is urging all users of the SMA1000 series to apply the newly released security updates to protect against these threats. Failure to patch could leave systems vulnerable to unauthorized access and potential data breaches. Users should prioritize this update to maintain the security of their networks.

SAP has issued critical updates in July 2026 to fix several vulnerabilities, including a serious flaw in the SAP NetWeaver Application Server ABAP, identified as CVE-2026-44747. This vulnerability has a CVSS score of 9.9 and involves an out-of-bounds write issue that could allow an authenticated attacker to exploit memory management errors. If successfully executed, this could lead to memory corruption, potentially enabling attackers to expose or modify sensitive data. Organizations using the affected SAP NetWeaver Application Server should prioritize these updates to protect their systems from possible exploitation. Timely patching is crucial to maintaining the integrity and confidentiality of their data.

Progress Software has confirmed that a serious zero-day vulnerability led to the emergency shutdown of ShareFile Storage Zone Controllers last week. Users of ShareFile, a cloud-based file sharing and storage service, were affected as the company worked to address the flaw. Progress has since released security updates to patch this vulnerability, which could have potentially allowed unauthorized access or data breaches. This incident is significant because it underscores the risks associated with cloud storage services, highlighting the need for users to ensure their systems are updated promptly to protect sensitive data.