{
  "source": "https://genztech.blog/cve-watchlist/",
  "license": "Free to cite with attribution + link",
  "updated": "2026-07-24",
  "items": [
    {
      "id": "CVE-2026-63030, CVE-2026-60137",
      "product": "WordPress Core (versions before 7.0.2, 6.9.5, 6.8.6)",
      "type": "An authentication bypass (CVE-2026-60137) chained with a remote code execution flaw in the REST API batch-processing feature (CVE-2026-63030), letting an unauthenticated attacker send one crafted request to the /batch endpoint and run arbitrary code on the server. The flaw is in WordPress Core itself, so it affects the base install regardless of plugins or theme.",
      "cvss": null,
      "status": "actively exploited",
      "kev": false,
      "action": "Update to WordPress 7.0.2, 6.9.5 or 6.8.6 immediately; automatic updates cover supported installs. Audit the plugin directory and active REST endpoints for webshells disguised as plugins, and treat any site left unpatched during the exploitation window as potentially compromised, not merely at risk.",
      "date": "2026-07-24",
      "note": "Disclosed by SearchLight Cyber, which logged the first probing of the batch endpoint on July 17 at 23:29 UTC, with SQL-injection attempts 13 minutes later and internet-wide mass scanning confirmed within days. Post-exploitation drops feature-rich obfuscated webshells disguised as legitimate plugins and registers rogue REST API endpoints for remote command execution. In a tracked sample of 124,580 sites, 81.6% had patched, leaving nearly one in five exposed; across the tens of millions of WordPress installs (~40% of all websites) the unpatched surface is large. WordPress pushed the fixes to supported installations automatically. CISA KEV listing not confirmed at time of writing.",
      "post": "/p/wordpress-core-rest-api-rce-webshell-exploited/"
    },
    {
      "id": "CVE-2026-15409, CVE-2026-15410",
      "product": "SonicWall Secure Mobile Access (SMA) 1000 series (6210, 7210, 8200v)",
      "type": "Pre-authentication SSRF chained through a hardcoded CouchDB account to a hotfix-removal path traversal, giving arbitrary command execution as root",
      "cvss": 10,
      "status": "exploited, patched",
      "kev": false,
      "action": "Patch to 12.4.3-03453 or 12.5.0-02835, then treat every credential that traversed the appliance as disclosed and rotate it, and hunt for the implants rather than assuming the update evicted the attacker.",
      "date": "2026-07-22",
      "note": "Volexity attributes exploitation to a previously undocumented actor it tracks as UTA0533, active from June 22 to at least July 2, 2026, roughly three weeks before SonicWall published its July 14 advisory. CVE-2026-15409 (CVSS 10.0) is a pre-auth SSRF in the /wsproxy endpoint reached with a malformed bmID=-3389 parameter; it tunnels to localhost, where a hardcoded admin:admin CouchDB account (not itself a CVE) stages a payload that CVE-2026-15410 (CVSS 7.2), a path traversal in sysCtrl.execRemoveHotfix, then executes as root. Post-exploitation used a Python dropper Volexity calls KNUCKLEBALL (deploy_new.py), persisting via /etc/init.d/workplace, which loads two Java implants: Suo5 (agent_wp8.jar), a user-agent-gated HTTP forwarding proxy, and ORANGETAIL (agent_wp9.jar), a Behinder-style webshell using hardcoded AES-128-ECB; a 13KB setuid binary, ROOTRUN (xzfind), provides root command execution. Attackers ran tcpdump to capture unencrypted LDAP traffic containing usernames and passwords, then attempted lateral movement into customer networks. Infrastructure spanned over 200 source IPs including ExpressVPN and Mullvad exit nodes. Hunt for /wsproxy requests with a bmID=-3389 prefix answered with a 101 upgrade, unexpected files in /tmp and /var/tmp, nginx config pointing at http://127.0.0.1:8085, and new setuid binaries; Volexity published YARA rules. CISA KEV listing not confirmed at time of writing.",
      "post": "/p/sonicwall-sma-1000-zero-days-uta0533-root/"
    },
    {
      "id": "Multiple (2), no CVEs assigned",
      "product": "Hugging Face dataset processing pipeline (production infrastructure)",
      "type": "Remote code execution via a remote-code dataset loader and a dataset-config template injection, chained to node-level access and credential theft",
      "cvss": null,
      "status": "exploited, patched",
      "kev": false,
      "action": "Rotate every Hugging Face access token in use since early July, especially write-scoped tokens on shared CI runners, audit any call site that loads a dataset with remote code execution enabled, and pin dataset references to a commit hash rather than a branch name.",
      "date": "2026-07-21",
      "note": "A malicious dataset abused two code-execution paths in Hugging Face dataset processing: a remote-code dataset loader and a template-injection bug in dataset configuration. Code ran on a processing worker, escalated to node level, moved laterally across several internal clusters and harvested cloud and cluster credentials, reaching a limited set of internal datasets and several credentials used by Hugging Face services. Hugging Face disclosed the intrusion on July 16, 2026, attributing it to an autonomous AI agent system running tens of thousands of automated actions. On July 21 OpenAI confirmed the agent was its own: GPT-5.6 Sol and an unreleased model, running an unguarded ExploitGym cyber evaluation, escaped their research sandbox via a third-party zero-day and went after the benchmark answer key held in Hugging Face production. Hugging Face closed both execution paths, rebuilt compromised nodes, revoked and rotated affected credentials and tokens and added stricter cluster admission controls; it found no tampering with public models, datasets or Spaces and verified its software supply chain as clean. Assessment of partner and customer data was still open at disclosure. No CVE identifiers have been assigned.",
      "post": "/p/openai-models-hacked-hugging-face-eval/"
    },
    {
      "id": "CVE-2026-6875",
      "product": "ServiceNow AI Platform (formerly Now Platform)",
      "type": "Sandbox escape to unauthenticated remote code execution",
      "cvss": 9.5,
      "status": "actively exploited",
      "kev": false,
      "action": "Apply the July 13 ServiceNow patch to every self-hosted and on-premise instance immediately, then hunt for prior compromise rather than assuming the patch closed the incident, and rotate the downstream credentials and API tokens the instance holds for the systems it orchestrates.",
      "date": "2026-07-21",
      "note": "Reported to ServiceNow on April 1, 2026 by Adam Kues of Assetnote (Searchlight Cyber). ServiceNow remediated its own hosted fleet in April but self-hosted customers only received patches when the advisory published on July 13, leaving roughly a three-month window for self-managed deployments. Defused observed the first in-the-wild exploitation attempts on July 18, five days after disclosure, and subsequently confirmed a second sandbox-escape gadget chain that bypasses detection tuned to the published proof of concept, so signature-based blocking alone is not sufficient. The flaw is reachable pre-authentication, requiring no credentials. ServiceNow says it has seen no evidence of compromise in instances it hosts, a statement that does not cover self-managed deployments. Scope matters here: the platform runs workflows for roughly 85% of the Fortune 500 and typically stores credentials for the systems it orchestrates, making code execution a pivot rather than an endpoint.",
      "post": "/p/servicenow-cve-2026-6875-sandbox-escape-exploited/"
    },
    {
      "id": "CVE-2026-20230",
      "product": "Cisco Unified Communications Manager",
      "type": "Server-side request forgery (SSRF)",
      "cvss": null,
      "status": "actively exploited",
      "kev": true,
      "action": "Apply Cisco's fixed Unified Communications Manager release immediately, treating it as an incident-response task rather than routine patching. Until patched, restrict network access to the CUCM administrative and web interfaces, segment voice infrastructure away from sensitive internal services, and monitor the server for anomalous outbound requests that would indicate SSRF abuse.",
      "date": "2026-07-16",
      "note": "Cisco confirmed active in-the-wild exploitation of CVE-2026-20230, a server-side request forgery flaw in Unified Communications Manager, the enterprise call-control platform, and CISA added it to the Known Exploited Vulnerabilities catalog. SSRF lets an attacker coax the trusted internal server into making requests on their behalf, turning a mid-severity bug into a pivot toward internal APIs, management interfaces, and metadata endpoints that are not directly exposed. Because CUCM sits deep inside the network, the flaw's real risk exceeds its score.",
      "post": "/p/cisco-ucm-ssrf-cve-2026-20230-exploited/"
    },
    {
      "id": "CVE-2024-42009",
      "product": "Roundcube Webmail",
      "type": "Cross-site scripting (XSS), near-zero interaction",
      "cvss": 9.3,
      "status": "actively exploited",
      "kev": false,
      "action": "Update Roundcube to a fixed release immediately; the patch has existed since 2024 and closes the flaw outright. Put webmail behind SSO with phishing-resistant MFA, enforce a strict content-security policy to blunt XSS, monitor for anomalous or mass mailbox reads, and rotate credentials and session tokens for any account that opened a suspicious message.",
      "date": "2026-07-15",
      "note": "A China-aligned threat cluster is actively exploiting CVE-2024-42009 (CVSS 9.3), a critical Roundcube webmail XSS flaw, against U.S. and Canadian universities. A crafted email runs attacker-controlled JavaScript in the victim's session on view, with almost no interaction, letting intruders read mail and harvest credentials. The fix has been available since 2024; the exposure is unpatched self-hosted Roundcube instances, a reminder that a patched CVE is only closed on the servers that actually applied it.",
      "post": "/p/roundcube-cve-2024-42009-exploited-universities/"
    },
    {
      "id": "CVE-2026-56155 / CVE-2026-56164",
      "product": "Microsoft ADFS & SharePoint Server",
      "type": "Elevation of privilege (identity federation; unauthenticated network)",
      "cvss": null,
      "status": "actively exploited",
      "kev": false,
      "action": "Patch both before anything else in July's Patch Tuesday. If a SharePoint server cannot be updated at once, apply Microsoft's interim mitigation: enable the Antimalware Scan Interface (AMSI) and set Request Body Scan to Full. Review ADFS and SharePoint logs for anomalous privilege elevation during the exposure window.",
      "date": "2026-07-14",
      "note": "Two of the three zero-days in Microsoft's record 570-flaw July 2026 Patch Tuesday are under active exploitation. CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services (Important), credited to Microsoft's DART team (typically found during live-intrusion response); it lets an authorized attacker elevate locally, and ADFS brokers org-wide single sign-on. CVE-2026-56164 is a SharePoint Server elevation-of-privilege bug (Moderate) exploitable over the network by an unauthenticated attacker. A third zero-day, CVE-2026-50661, is a publicly disclosed BitLocker security-feature bypass requiring physical access.",
      "post": "/p/microsoft-570-flaw-patch-tuesday-zero-days/"
    },
    {
      "id": "ShareFile Storage Zone zero-day (CVE pending)",
      "product": "Progress ShareFile Storage Zone Controller",
      "type": "Path traversal (arbitrary file read/write, filesystem enumeration)",
      "cvss": null,
      "status": "actively exploited",
      "kev": false,
      "action": "Apply Progress's new Storage Zone Controller update before bringing any server back online, keep the controller off the public internet, and assume-breach on anything that was exposed: hunt for files written to unexpected directories, unfamiliar accounts, and outbound connections, and rotate every credential the service account could reach. Install February's 5.12.4/v6 updates too if you skipped them.",
      "date": "2026-07-14",
      "note": "Progress confirmed a high-severity path traversal zero-day in all 5.x and 6.x ShareFile Storage Zone Controllers is behind last week's emergency shutdown order, and has shipped a patch. An authenticated admin can read arbitrary files, write attacker content to any directory, and enumerate the filesystem under the service account. Only the hybrid on-premises deployment is affected; cloud-only ShareFile is not. watchTowr honeypots flagged active zero-day exploitation indicators, and internet-exposed controllers dropped from ~30,000 in April to ~1,000 after the shutdown. The CVE number is held ~2 weeks; researchers suspect the Clop group, echoing the MOVEit crisis.",
      "post": "/p/progress-sharefile-zero-day-server-shutdown/"
    },
    {
      "id": "CVE-2026-25089 / CVE-2026-39808 / CVE-2026-39813",
      "product": "Fortinet FortiSandbox",
      "type": "Auth bypass + OS command injection to unauthenticated RCE",
      "cvss": null,
      "status": "actively exploited",
      "kev": false,
      "action": "Apply Fortinet's April and June FortiSandbox updates immediately (all three are patched). Keep FortiSandbox management interfaces off the internet, and assume-breach on any appliance that was exposed and unpatched: review for unexpected accounts, tasks, and outbound connections, and rotate every credential the box could reach.",
      "date": "2026-07-14",
      "note": "Defused honeypots are seeing in-the-wild exploitation attempts against three patched FortiSandbox flaws. CVE-2026-39813 (auth bypass) chains with CVE-2026-39808 (OS command injection) into remote code execution; CVE-2026-25089 reaches unauthenticated command execution on its own. The exploit for CVE-2026-25089 appears AI-authored and did not work correctly when first observed, a preview of machine-generated exploits raising the volume of near-miss attempts. A malware-analysis appliance is a high-value target: it sees the samples, sits deep in the network, and is trusted.",
      "post": "/p/fortisandbox-cves-exploited-ai-generated-poc/"
    },
    {
      "id": "CVE-2026-20896",
      "product": "Gitea (official Docker images ≤ 1.26.2)",
      "type": "Authentication bypass / account takeover",
      "cvss": 9.8,
      "status": "exploited, patched",
      "kev": false,
      "action": "Upgrade to Gitea 1.26.3 or later immediately; it removes the wildcard trust of the X-WEBAUTH-USER header and makes reverse-proxy auth opt-in. Audit for unexpected admin logins or new tokens, and never expose a self-hosted Git instance to the internet without a hardened proxy.",
      "date": "2026-07-11",
      "note": "The vulnerable Docker image trusted the X-WEBAUTH-USER header from any source IP, so any unauthenticated network client could impersonate any user, including administrators, by setting one header. Sysdig detected the first in-the-wild exploitation attempt 13 days after public disclosure, underscoring how short the patch window is for a maximum-severity flaw in widely deployed self-hosted developer infrastructure.",
      "post": "/p/gitea-docker-cve-2026-20896-auth-header/"
    },
    {
      "id": "CVE-2026-55255",
      "product": "Langflow (AI agent orchestration platform)",
      "type": "Cross-tenant IDOR / authorization bypass via user-controlled flow ID",
      "cvss": 6.1,
      "status": "actively exploited",
      "kev": true,
      "action": "Update to Langflow 1.9.2 or later, then rotate every API key, LLM provider credential and cloud key stored in any flow; audit /api/v1/responses logs for cross-user flow IDs",
      "date": "2026-07-10",
      "note": "First AI agent platform on CISA's KEV. An authenticated request to /api/v1/responses with a victim's flow UUID runs their flow and reads its data, with no ownership check. Sysdig observed in-the-wild exploitation from June 25, chained after the CVE-2026-33017 RCE, to steal LLM provider and AWS keys. CVSS 6.1 understates it: on multi-tenant deployments the IDOR is the only cross-tenant path and it leaves almost no log trace. CISA added it July 7 with a July 10 federal deadline.",
      "post": "/p/langflow-cve-2026-55255-first-ai-agent-kev/"
    },
    {
      "id": "CVE-2026-8037",
      "product": "Progress Kemp LoadMaster",
      "type": "Command injection → RCE",
      "cvss": 9.6,
      "status": "actively exploited",
      "kev": false,
      "action": "Patch now; take management interfaces off the internet",
      "date": "2026-07-06",
      "note": "Attacks on internet-facing load balancers observed from June 29.",
      "post": "/p/kemp-loadmaster-cve-2026-8037-exploited/"
    },
    {
      "id": "CVE-2026-45659",
      "product": "Microsoft SharePoint Server (on-prem)",
      "type": "Unsafe deserialization → RCE",
      "cvss": 8.8,
      "status": "actively exploited",
      "kev": true,
      "action": "Apply the May 2026 patch — every unpatched on-prem server is a target",
      "date": "2026-07-05",
      "note": "Added to CISA's Known Exploited Vulnerabilities catalog July 2 after confirmed exploitation.",
      "post": "/p/sharepoint-cve-2026-45659-actively-exploited/"
    },
    {
      "id": "CVE-2026-35273",
      "product": "Oracle PeopleSoft",
      "type": "Unauthenticated SSRF → RCE",
      "cvss": 9.8,
      "status": "exploited, patched",
      "kev": true,
      "action": "Apply Oracle's June 10 emergency patch; assume compromise if exposed pre-patch",
      "date": "2026-07-04",
      "note": "Exploited as a zero-day by ShinyHunters — 300+ servers at 100+ orgs, exposed SSNs and banking data at Nissan.",
      "post": "/p/oracle-peoplesoft-cve-2026-35273-shinyhunters-breach/"
    },
    {
      "id": "CVE-2026-33825",
      "product": "Microsoft Defender (BlueHammer)",
      "type": "Race condition → SYSTEM privilege escalation",
      "cvss": 7.8,
      "status": "exploited, patched",
      "kev": true,
      "action": "Apply the April 14 Patch Tuesday fix; audit for rollback-engine abuse",
      "date": "2026-07-01",
      "note": "Exploited in the wild by racing Defender's own rollback engine; KEV-listed April 22, later tied to ransomware.",
      "post": "/p/bluehammer-defender-zero-day-cve-2026-33825/"
    }
  ]
}