> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # The Top CVEs of July 2026: Four SharePoint Zero-Days and a Record 569-CVE Patch Tuesday - URL: https://www.thecybersignal.com/cve-watch-july-2026-2/ - Published: 2026-08-04T08:39:00.000Z - Updated: 2026-08-22T13:12:42.000Z - Description: July belonged to SharePoint — four separate flaws exploited in the wild — while Microsoft shipped the largest Patch Tuesday in its history at 569 CVEs. Here's what to fix first. - Author: Nicholas Robert - Tags: CVE Watch *July belonged to SharePoint — four separate flaws exploited in the wild — while Microsoft shipped the largest Patch Tuesday in its history at 569 CVEs. Here's what to fix first, and why the raw severity score is the wrong place to start.* Key Takeaways - On-prem **SharePoint** was the story of the month: four distinct CVEs (CVE-2026-58644, CVE-2026-50522, CVE-2026-56164, CVE-2026-55040) were exploited in the wild, two of them zero-days patched on Patch Tuesday and two more driven by public proof-of-concept code. - Microsoft's July Patch Tuesday was the **largest ever — 569 CVEs** (56 critical, three zero-days), a volume Microsoft partly attributes to an AI-assisted vulnerability-discovery pipeline. - Security and edge appliances kept bleeding: **Check Point SmartConsole, Cisco Secure FMC, SonicWall SMA1000, and Fortinet FortiOS** all landed on CISA's KEV list within the month. - The lowest scores did the most damage: Cisco FMC (5.3) and Fortinet FortiOS (5.3) were both actively exploited — proof that **exploitation, not CVSS, should drive your patch queue**. ## How we rank (the CyberSignal method) We don't rank by CVSS. We rank by the risk a vulnerability actually poses to a defender this week, using four signals in order. First, **confirmed active exploitation** — a CISA KEV listing or credible in-the-wild evidence outranks any theoretical severity. Second, **exposure and attacker value** — internet-facing, unauthenticated, and widely deployed beats deep-internal or hard-to-reach. Third, **patch availability** — an unpatched or PoC-outpacing-the-fix bug is more urgent than one you can simply update away. Fourth, **blast radius** — identity providers, collaboration servers, edge devices, and CI/CD pipelines carry far more downstream than a single endpoint. A quietly exploited 5.3 will always sit above a critical-rated 9.8 that no one is touching. ## The July 2026 ranked list | # | CVE | Product | CVSS | Status | Do this | | -- | -------------- | ------------------------------------------------------------- | ----------------- | --------------------------------- | ------------------------------------------------------------------------------ | | 1 | CVE-2026-58644 | Microsoft SharePoint Server 2016 / 2019 / SE (unauth RCE) | 9.8 | **Exploited · CISA KEV (Jul 17)** | Apply the July SharePoint update; hunt for web shells and rotate machine keys. | | 2 | CVE-2026-50522 | Microsoft SharePoint Server (deserialization RCE) | 9.8 | **Exploited · CISA KEV (Jul 22)** | Patch now; public PoC — assume compromise and threat-hunt. | | 3 | CVE-2026-56164 | Microsoft SharePoint Server (missing auth → priv-esc) | 9.8 (NVD; MS 5.3) | **Exploited · CISA KEV (Jul 14)** | Install July Patch Tuesday; restrict anonymous access to the farm. | | 4 | CVE-2026-56155 | Microsoft AD FS (insufficient access control → EoP) | 7.8 | **Exploited · CISA KEV (Jul 14)** | Patch AD FS; review federation trusts and token-issuance logs. | | 5 | CVE-2026-16232 | Check Point SmartConsole (auth bypass) | 9.3 | **Exploited · CISA KEV (Jul 22)** | Upgrade SmartConsole; rotate admin tokens and audit management access. | | 6 | CVE-2026-20316 | Cisco Secure Firewall Management Center (hard-coded password) | 5.3 (Cisco 8.9) | **Exploited · CISA KEV (Jul 29)** | Apply Cisco's fix — the static account can't be removed any other way. | | 7 | CVE-2026-15409 | SonicWall SMA1000 (6210 / 7210 / 8200v) — unauth SSRF | 10.0 | **Exploited · CISA KEV (Jul 14)** | Patch SMA1000 firmware; watch for anomalous outbound requests. | | 8 | CVE-2026-15410 | SonicWall SMA1000 (authenticated command injection) | 7.2 | **Exploited · CISA KEV (Jul 14)** | Same firmware update; audit admin accounts for abuse. | | 9 | CVE-2025-68686 | Fortinet FortiOS (info disclosure / patch bypass) | 5.3 | **Exploited · CISA KEV (Jul 27)** | Patch FortiOS; remove malicious symlinks left by earlier intrusions. | | 10 | CVE-2026-0770 | Langflow (unauth RCE via exec\_globals) | 9.8 | **Exploited · CISA KEV (Jul 21)** | Upgrade Langflow; never expose the builder to the internet. | | 11 | CVE-2026-55255 | Langflow (IDOR / authorization bypass, < 1.9.2) | 9.9 | **Exploited · CISA KEV (Jul 7)** | Upgrade to 1.9.2+; enforce auth on /api/v1/responses. | | 12 | CVE-2026-63030 | WordPress Core 6.8.x–7.0.x (“wp2shell” RCE) | 7.5 | **Exploited · CISA KEV (Jul 21)** | Confirm core auto-updates applied; review REST API logs. | | 13 | CVE-2021-27137 | DD-WRT router firmware (UPnP buffer overflow) | 8.1 | **Exploited · CISA KEV (Jul 21)** | Update or replace firmware; disable UPnP and WAN-side management. | *CVSS per NVD/CISA; rank reflects exploitation and exposure, not the raw score.* ## Tier 1 — Actively exploited (fix these first) **SharePoint was under siege from four directions at once.** Two on-prem SharePoint zero-days — the missing-authentication flaw CVE-2026-56164 and the unauthenticated RCE CVE-2026-58644 — were exploited before or alongside their July fixes, and CISA gave the RCE a compressed remediation deadline. We covered the moment CISA [added CVE-2026-58644 to the KEV catalog with a July 19 patch deadline](https://www.thecybersignal.com/cisa-sharepoint-cve-2026-58644-kev-july-19-deadline-2026/), and Rapid7's subsequent [deep-dive on the exploited chain](https://www.thecybersignal.com/rapid7-sharepoint-cve-2026-58644-deep-dive-2026/) is worth reading before you close out the incident. CISA's broader alert [urged immediate patching for three exploited SharePoint vulnerabilities, two of them zero-days](https://www.thecybersignal.com/cisa-sharepoint-three-exploited-two-zero-days-2026/) — the third being the JWT authentication bypass CVE-2026-55040 that lets an attacker impersonate any user or admin. **Then the pattern repeated with public exploit code.** Barely a week later, proof-of-concept code turned CVE-2026-50522 into a mass-exploitation event within hours of release. Our report on this [fourth actively exploited SharePoint vulnerability](https://www.thecybersignal.com/sharepoint-cve-2026-50522-fourth-active-exploitation-2026/) is the clearest signal of the month: if you run on-prem SharePoint, treat every farm as a target and assume the window between disclosure and exploitation is measured in hours, not weeks. **Identity was the other prize.** CVE-2026-56155 in Active Directory Federation Services was exploited in the wild as a zero-day before its patch and grants an authorized attacker broader domain-level access — a modest 7.8 with an outsized blast radius, because AD FS sits at the center of [single sign-on](https://www.thecybersignal.com/what-is-single-sign-on-sso-benefits-and-security-risks/) and federated trust. **Security and edge appliances stayed in the crosshairs.** Check Point's SmartConsole authentication bypass ([CVE-2026-16232](https://www.thecybersignal.com/check-point-smartconsole-cve-2026-16232-active-exploitation-2026/)) hands an unauthenticated attacker a full-admin token to the console that manages your security policy. Cisco's Secure Firewall Management Center flaw ([CVE-2026-20316](https://www.thecybersignal.com/cisco-fmc-cve-2026-20316-zero-day-exploited-2026/)) is a hard-coded password that no configuration change can remove — only the vendor fix does. SonicWall's SMA1000 pair (CVE-2026-15409, a perfect-10.0 unauthenticated SSRF, and CVE-2026-15410) were exploited as zero-days against internet-facing VPN gateways, and Fortinet's FortiOS bug (CVE-2025-68686) is a patch-bypass that quietly re-enables malicious symlinks on devices you thought you'd cleaned. None of these is optional. ## Tier 2 — Patch-now criticals (no confirmed attacks yet) July's Patch Tuesday was the largest in Microsoft's history: **569 CVEs**, of which 56 were rated critical and three were zero-days. Two of those zero-days (the SharePoint and AD FS flaws above) were already being exploited; the third, **CVE-2026-50661**, is a BitLocker security-feature bypass that was publicly disclosed but not yet exploited — it requires physical access to read encrypted data, so it belongs on the patch queue but below anything internet-facing. Microsoft has attributed part of this record volume to an AI-assisted discovery pipeline scanning its own codebase, which means defenders should expect large, dense Patch Tuesdays to become the norm rather than the exception. Prioritize the handful of critical, network-reachable RCEs in your specific product footprint first, then work down; the raw count is a triage problem, not a reason to panic. ## Tier 3 — Self-hosted / infrastructure **AI tooling is now part of the attack surface.** Langflow — a visual builder for AI agents — earned two KEV entries in a single month: the IDOR authorization bypass CVE-2026-55255 (9.9) and the unauthenticated code-execution flaw CVE-2026-0770 (9.8). The lesson security teams keep relearning is that a self-hosted AI framework deserves the same inventory, patching, and network-segmentation discipline as any other server. The same goes for the web tier: two WordPress Core flaws hit KEV together, led by the “wp2shell” pre-auth RCE (CVE-2026-63030) that chains REST-API route confusion with [SQL injection](https://www.thecybersignal.com/what-is-sql-injection-sqli/) across WordPress 6.8 through 7.0\. And the reappearance of a 2021 DD-WRT buffer overflow (CVE-2021-27137) is a reminder that router and appliance firmware, often invisible to vulnerability-management programs, gives attackers durable footholds. If it's self-hosted and it faces the network, it needs the same rigor as your crown-jewel servers. --- ## The CyberSignal Analysis ### Signal 01 — The disclosure-to-exploitation window has collapsed The through-line of July is speed. CVE-2026-50522 went from public PoC to honeypot hits in hours; CVE-2026-58644 arrived with a compressed CISA deadline because attackers were already moving. For a defender, patch cadence measured in weeks is no longer a coherent strategy for internet-facing, widely deployed software like SharePoint. The practical response is to pre-stage: know your on-prem SharePoint and AD FS inventory now, subscribe to the KEV feed as an operational trigger, and rehearse the emergency-patch path before you need it. ### Signal 02 — CVSS keeps failing as a priority signal The two most instructive entries this month scored 5.3\. Cisco's FMC hard-coded password and Fortinet's FortiOS patch-bypass were both actively exploited while carrying “medium” base scores, and Langflow's most-exploited flaw wasn't its highest-scored one. Severity measures theoretical impact under ideal conditions; it says nothing about whether an exploit exists, whether the asset is reachable, or whether attackers care. A KEV listing is worth more than a CVSS of 9.8, and any patch-prioritization program that sorts purely by score will spend July fixing the wrong things. ### Signal 03 — AI is now on both sides of the ledger Microsoft credits an AI pipeline for surfacing much of a record 569-CVE release, while attackers added an AI-agent framework (Langflow) to their target list twice in one month. The defensive takeaway isn't to fear the volume — it's to industrialize triage. When the flow of disclosed vulnerabilities scales faster than any human queue, the teams that win are the ones automating the mapping from CVE to affected-asset to exploitation-status, so a human only ever looks at the short list that is both reachable and being hit. Defender Checklist — July 2026 - Inventory every on-prem SharePoint farm and apply the July updates for CVE-2026-58644, CVE-2026-50522, CVE-2026-56164, and CVE-2026-55040; then threat-hunt for web shells and rotate machine keys. - Patch AD FS (CVE-2026-56155) and review federation trusts and token-issuance logs for abuse. - Update security and edge appliances now: Check Point SmartConsole (CVE-2026-16232), Cisco Secure FMC (CVE-2026-20316), SonicWall SMA1000 (CVE-2026-15409 / 15410), and Fortinet FortiOS (CVE-2025-68686). - Upgrade self-hosted Langflow (CVE-2026-0770 / CVE-2026-55255) and confirm WordPress core auto-updates (CVE-2026-63030); pull AI and web frameworks into your patch program. - Deploy the wider July Patch Tuesday set, prioritizing network-reachable critical RCEs in your footprint; schedule the BitLocker bypass (CVE-2026-50661) behind internet-facing fixes. - Re-sort your patch queue by KEV / active-exploitation status, not CVSS — two of this month's exploited flaws scored just 5.3. --- ## Sources | Type | Source | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CISA KEV | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=thecybersignal.com) (July 2026 additions: Jul 7, 14, 21–22, 27, 29) | | Patch Tuesday | [Tenable](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164?ref=thecybersignal.com) and [BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/?ref=thecybersignal.com) — July 2026 Patch Tuesday (569–570 CVEs, three zero-days) | | Vendor advisory | SonicWall [SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008?ref=thecybersignal.com) (SMA1000); Rapid7 on [Check Point SmartConsole CVE-2026-16232](https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/?ref=thecybersignal.com) and [WordPress wp2shell CVE-2026-63030](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/?ref=thecybersignal.com); [Cisco Secure FMC CVE-2026-20316](https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/?ref=thecybersignal.com) | | NVD | [CVE-2026-56164](https://nvd.nist.gov/vuln/detail/CVE-2026-56164?ref=thecybersignal.com), [CVE-2026-56155](https://nvd.nist.gov/vuln/detail/CVE-2026-56155?ref=thecybersignal.com), [CVE-2026-50522](https://nvd.nist.gov/vuln/detail/CVE-2026-50522?ref=thecybersignal.com) and related records for CVSS verification | | CyberSignal | [CISA urges patching for three exploited SharePoint flaws](https://www.thecybersignal.com/cisa-sharepoint-three-exploited-two-zero-days-2026/), [CVE-2026-58644 added to KEV](https://www.thecybersignal.com/cisa-sharepoint-cve-2026-58644-kev-july-19-deadline-2026/), [Rapid7 deep-dive](https://www.thecybersignal.com/rapid7-sharepoint-cve-2026-58644-deep-dive-2026/), [CVE-2026-50522 fourth active exploitation](https://www.thecybersignal.com/sharepoint-cve-2026-50522-fourth-active-exploitation-2026/), [CVE-2026-55040 JWT auth bypass](https://www.thecybersignal.com/microsoft-sharepoint-cve-2026-55040-jwt-auth-bypass-2026/) | *The CyberSignal's CVE Watch is published monthly.*