Vulnerability Report - July 2026

Introduction

This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently sighted vulnerabilities for July 2026, based on data aggregated from Vulnerability-Lookup, the CISA Known Exploited Vulnerabilities catalog, the CIRCL KEV catalog, the ENISA EUVD / EU CSIRTs Network feed, honeypot observations from The Shadowserver Foundation, the KEVIntel catalog, and contributor comments and bundles. These five KEV catalogs are federated through the GCVE initiative: each one is identified by the UUID of the entity that publishes it, and exchanged between instances following the GCVE-BCP-07 specification – which is what makes the catalog coverage comparison further down possible. Sightings come from MISP, Exploit-DB, Bluesky, Mastodon, Telegram, GitHub Gists, Nuclei, SPLOITUS, Metasploit, and more. For further details, please visit this page.

July was a month of web-platform and business-application mass exploitation. Where June’s threat landscape was dominated by network appliances, July’s centre of gravity moved to the software running on top of them: four Microsoft SharePoint flaws, a chained pair of WordPress core vulnerabilities, and an entire wave of Joomla extensions all entered the CISA KEV catalog within a few weeks of each other. Appliances did not disappear – Cisco, Fortinet, SonicWall, Arista and Check Point each contributed KEV entries – but the commodity web stack was where attackers spent their July.

The Month at a Glance

9,808 CVEs were published in July 2026 (from the CVE List v5 source alone), up from 7,964 in June – a 23.2% month-over-month increase and, once again, the highest monthly volume ever recorded. Vulnerability-Lookup also ingested 10,012 GitHub security advisories and 2,796 PySec advisories over the same period.

Vulnerability-Lookup collected 61,263 sightings across 17,300 distinct vulnerabilities during July 2026 – more than double June’s 27,251. The breakdown:

The published proof of concept category is the single largest driver of the month’s growth, rising from 515 sightings in June to 6,092 in July – close to a twelvefold increase. The daily breakdown below shows it is not a gradual trend: proof-of-concept reporting stays under 30 per day until July 11, then jumps into the hundreds and stays elevated for the rest of the month, peaking at 1,071 on July 31 – a day when proof-of-concept sightings outnumbered every other type combined. These come predominantly from Telegram channel monitoring and GitHub, and give an early-warning signal that sits between “discussed” and “actively exploited”.

Running the other way, exploitation-typed sightings fell by more than half, from roughly 8,500 in June to 3,705 in July, so the doubling of total volume is a reporting-coverage effect rather than a surge in observed exploitation. No “patched” sightings were recorded this month.

Across the monitored KEV catalogs, 26 entries were added by CISA, 2 by CIRCL, 2 were reported by CERT-PL through the ENISA / EU CSIRTs Network feed, 24 new vulnerabilities appeared for the first time in The Shadowserver Foundation’s honeypot-observed exploitation feed, and 48 were added by KEVIntel.

Microsoft SharePoint was the story of the month, with four separate CISA KEV additions in four weeks: CVE-2026-45659 (July 1), CVE-2026-56164 (July 14), CVE-2026-58644 (July 16) and CVE-2026-50522 (July 22). Three of the four are deserialization of untrusted data (CWE-502) and the fourth is a missing-authentication issue (CWE-306); two of them landed in the month’s top 10 most sighted vulnerabilities. Contributors also curated a bundle on a related SharePoint JWT authentication bypass (CVE-2026-55040).

WordPress core produced the two most sighted vulnerabilities of the month, and they are a chain: CVE-2026-60137, an unsanitised author__not_in parameter in WP_Query, becomes remote code execution when combined with CVE-2026-63030, a REST API batch endpoint route confusion issue. Both were added to the CISA KEV catalog on July 21, and both accumulated large numbers of proof-of-concept sightings (125 and 79 respectively).

A Joomla extension wave ran through the first half of the month. CISA added four entries in four days – CVE-2026-48908 (JoomShaper SP Page Builder), CVE-2026-56290 (Page Builder CK), CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) – three of them unrestricted file upload (CWE-434) leading to PHP execution. The same cluster was reported independently by CERT-PL to the ENISA CNW feed, and CIRCL confirmed the SP Page Builder issue.

The AI stack appears for the third month in a row, and more heavily than before: two Langflow entries in the CISA catalog (CVE-2026-0770, unauthenticated RCE via exec_globals, and CVE-2026-55255, an IDOR allowing execution of another user’s flows), plus a Langflow arbitrary file write (CVE-2026-5027) and sustained honeypot traffic against BerriAI LiteLLM (CVE-2026-42271, 220 honeypot connections in a single day) in the Shadowserver feed. KEVIntel widens the picture further with three Flowise flaws, the ServiceNow AI Platform (CVE-2026-6875) and two workflow-orchestration projects – none of which appear in any other tracked catalog.

On the infrastructure side, Fortinet had three KEV entries (an information disclosure in FortiOS and two FortiSandbox command injections), SonicWall SMA1000 contributed a pair (SSRF + post-authentication code injection), Cisco Secure Firewall Management Center shipped with a hard-coded password (CVE-2026-20316), and the Check Point SmartConsole authentication bypass (CVE-2026-16232) – which hands an attacker full administrative privileges over security policy – was listed by both CISA and CIRCL. CVE-2026-46817, an unauthenticated takeover of Oracle Payments in E-Business Suite, and the CVSS 10.0 Adobe ColdFusion path traversal CVE-2026-48282 rounded out the business-application picture; ColdFusion was seen against Shadowserver honeypots the day after its KEV listing.

CISA also re-anchored some remarkably old issues this month: a 2008 Cisco IOS cross-site request forgery (CVE-2008-4128), a DD-WRT UPnP stack overflow from 2021 (CVE-2021-27137) and a KNX protocol account-lockout weakness (CVE-2023-4346). And in the exploitation-typed sightings, Log4Shell (CVE-2021-44228) was still the single most reported vulnerability of the month, ahead of the React Server Components pre-authentication RCE CVE-2025-55182.

Across the month’s KEV additions, the dominant weakness patterns were deserialization of untrusted data (CWE-502: three SharePoint entries), unrestricted file upload (CWE-434: the Joomla extension cluster), OS command and code injection (CWE-77/78/94: FortiSandbox, Arista VeloCloud Orchestrator, SonicWall SMA1000), improper authentication and access control (CWE-284/287/306: Check Point SmartConsole, SharePoint, Oracle E-Business Suite, Page Builder CK), and SQL injection (CWE-89: WordPress core).

Overall published volume tells a different story from the exploitation data. July’s CWE ranking is dominated by memory-safety weaknesses – use-after-free (CWE-416) alone accounts for roughly 4,900 occurrences, ahead of heap-based buffer overflow (CWE-122), out-of-bounds read (CWE-125) and race conditions (CWE-362) – pushing cross-site scripting (CWE-79) down to fifth place for the first time this year. This is a direct consequence of the Linux kernel CVE flood, which also put two kernel issues in the month’s ten most sighted vulnerabilities.

Top 10 Vendors of the Month

Oracle leads July’s vendor ranking – the effect of its quarterly Critical Patch Update – ahead of Linux and Microsoft.

Top 10 Assigners of the Month

Top 10 Credits of the Month

WPScan and the VulDB CNA Team top the credits ranking for July, each credited on more than 200 published vulnerabilities.

The complete list of credits is available on Vulnerability-Lookup.

Top 10 Vulnerabilities of the Month

Known Exploited Vulnerabilities

New entries were added to the tracked Known Exploited Vulnerabilities catalogs during July. The five catalogs are complementary rather than redundant: CISA is the reference set, CIRCL and the ENISA / EU CSIRTs Network feed add European confirmations, Shadowserver’s honeypots show what is actually being attacked on the wire, and KEVIntel aggregates public exploitation reports at higher volume and often earlier – each of the last two surfacing vulnerabilities no other catalog lists.

Catalog coverage

65 distinct vulnerabilities entered at least one of the tracked KEV catalogs during July. The matrix below shows, for each of them, which catalogs cover it (as of publication) – built with the KEV catalog coverage feature of Vulnerability-Lookup. KEVIntel is by far the widest net with 61 of the 65, ahead of CISA (34, including entries it had listed before July) and Shadowserver (25). Only one vulnerability of the month is present in four catalogs at once: the JoomShaper SP Page Builder file upload CVE-2026-48908, reported by CERT-PL, confirmed by CIRCL, and listed by both CISA and KEVIntel.

At the other end, 19 entries are visible through a single catalog: 15 only via KEVIntel (the Flowise, conductor and windmill cluster, the ServiceNow AI Platform, Citrix NetScaler, phpBB, Fastjson and several older high-EPSS issues), 3 only via Shadowserver’s honeypots (CVE-2026-3836, CVE-2026-1125 and CVE-2022-50992), and 1 only via CISA (the SharePoint deserialization flaw CVE-2026-58644). Every CIRCL and ENISA entry of the month is corroborated elsewhere.

CISA

The CISA KEV catalog added 26 entries in July, its busiest month of the year. None of them carries a known ransomware campaign use flag.

More KEV entries from the CISA Catalog.

CIRCL

The CIRCL KEV catalog added 2 entries during July, both marked as confirmed exploitation.

More KEV entries from the CIRCL Catalog.

ENISA (EUVD)

Two entries were reported through the ENISA / EU CSIRTs Network (CNW) KEV feed during July, both by CERT-PL and both concerning widely deployed Joomla extensions – the same cluster CISA picked up the following day.

More KEV entries from the ENISA Catalog.

The Shadowserver Foundation

The Shadowserver KEV catalog is fed by honeypot-observed exploitation attempts. 24 vulnerabilities were observed for the first time during July, six of which are also in the CISA KEV catalog. Several of the June KEV headliners – Oracle PeopleSoft, Ubiquiti UniFi, Splunk, LiteLLM – only started drawing honeypot traffic in July, illustrating the lag between catalog listing and opportunistic mass scanning. The Zyxel NAS326/NAS542 command injection stands out with 1,585 honeypot connections in a single day.

More KEV entries from the Shadowserver Catalog.

KEVIntel

The KEVIntel catalog aggregates public exploitation reports and added 48 entries in July – the highest volume of the tracked feeds, and enough to cover 25 of CISA’s 26 additions for the month (only the SharePoint deserialization flaw CVE-2026-58644 is absent from it).

Six of those it flagged before CISA did: the Fortinet FortiSandbox command injection CVE-2026-39808 on June 12, a full 34 days ahead; the Oracle E-Business Suite takeover CVE-2026-46817 on June 29, 16 days ahead; the Adobe ColdFusion path traversal CVE-2026-48282 by 5 days; the two WordPress core issues CVE-2026-63030 and CVE-2026-60137 by 3 days; and the SharePoint RCE CVE-2026-50522 by one day.

16 entries are unique to KEVIntel this month. Among them, the AI and workflow-automation stack is conspicuous – three Flowise flaws (CVE-2025-71334, CVE-2026-46442, CVE-2024-36420), the ServiceNow AI Platform (CVE-2026-6875, also the 14th most sighted vulnerability of the month), conductor-oss (CVE-2026-58138) and windmill (CVE-2026-29059) – alongside the Citrix NetScaler pre-authentication memory overread CVE-2026-8451 covered in a contributor bundle below. High-EPSS legacy issues also resurface here: Apache Struts CVE-2016-3081 (93.2% EPSS), Zyxel NAS CVE-2024-29972 (89.2%) and Cacti CVE-2023-39361 (87.6%).

Vendor, product, CVSS and EPSS values below are reproduced as published by KEVIntel.

More KEV entries from the KEVIntel Catalog.

Top 10 Weaknesses of the Month

Insights from Contributors

A researcher contributed a first-hand clarification on their own finding this month:

• Researcher clarification and primary references for CVE-2026-14440 – David Osipov, credited finder of CVE-2026-14440, explains that Cloudflare Universal SSL’s automatic management of the effective CAA RRset can supersede customer-configured CAA records, so RFC 8657 accounturi and validationmethods constraints may never reach the Certificate Authority. The comment is notable for calibrating the risk rather than inflating it: exploitation requires a network-level attacker capable of defeating the CA’s domain validation and Multi-Perspective Issuance Corroboration, and no in-the-wild exploitation is known. It also points out that Certificate Transparency monitoring detects misissuance but does not prevent it, and that operators needing strict RFC 8657 enforcement should ensure another valid edge certificate is active before disabling Universal SSL – along with a set of persistent primary references (CVE record, CISA CSAF advisory, archived research release).

Contributors also curated vendor advisories and research into bundles during July:

• Unifi - Security Advisory Bulletin 066 (25 CVEs) – the month’s largest bundle, grouping Ubiquiti’s July 2 bulletin covering improper access control and related issues across the UniFi line.
• CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) (8 CVEs) – watchTowr’s analysis of CVE-2026-8451, linked together with the earlier CitrixBleed lineage including CVE-2025-5777.
• VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates (5 CVEs) – Broadcom’s July 29 advisory across the VMware hypervisor and desktop products.
• Check Point Blog - Security Advisory, July 2026 Security Update (3 CVEs) – the jumbo hotfix that fixed the KEV-listed SmartConsole authentication bypass CVE-2026-16232 alongside two further hardening fixes.
• CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED) (1 CVE) – Rapid7’s write-up of a SharePoint JWT token authentication bypass, a useful companion to the four SharePoint KEV entries of the month.

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Funding

The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole.
Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL’s contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release

AIPITCH (AI-Powered Innovative Toolkit for Cybersecurity Hubs) is a co-funded EU project supported by the European Cybersecurity Competence Centre (ECCC) under the DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH program and CIRCL.
The VLAI severity levels used throughout this report are produced by models developed as part of AIPITCH.