cybr.cx — Daily Digest | July 29, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-16812 | Arista VeloCloud Orchestrator | CVSS: N/A
An OS command injection vulnerability in Arista's VeloCloud Orchestrator On-Prem allows a remote attacker to access privileged internal functionality and fully compromise the host — confidentiality, integrity, and availability all at risk. CISA's remediation deadline was yesterday (July 30). If you're running VCO on-prem and haven't patched, treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-16232 | Check Point SmartConsole | CVSS: N/A
An improper authentication flaw lets an unauthenticated remote attacker grab a valid application login token and authenticate with full administrative privileges to SmartConsole. Full admin access to your firewall management plane without credentials is about as bad as it gets. Patch now — CISA's deadline has already passed (July 25).

⚠️ Actively exploited — CVE-2026-50522 | Microsoft SharePoint | CVSS: N/A
A deserialization of untrusted data vulnerability enables unauthenticated remote code execution over the network. SharePoint is a high-value target for both ransomware operators and espionage actors. The July patch addresses this — if you're behind on SharePoint updates, move it to the top of the queue. CISA deadline passed July 25.

⚠️ Actively exploited — CVE-2026-60137 + CVE-2026-63030 | WordPress Core | CVSS: N/A
These two are chained in the wild: CVE-2026-60137 is a SQL injection triggered when plugins or themes pass untrusted input to a vulnerable parameter, and CVE-2026-63030 is an interpretation conflict that elevates that SQL injection to unauthenticated remote code execution on default WordPress installations. Any unpatched WordPress site is at active risk. Update core immediately and audit third-party plugins passing user input to database queries.

⚠️ Actively exploited — CVE-2025-68686 | Fortinet FortiOS | CVSS: N/A
This one is particularly nasty — it allows a remote unauthenticated attacker to bypass the symbolic link persistence patch that Fortinet previously issued, via crafted HTTP requests. Threat actors are already using it to re-establish footholds on systems operators thought were remediated. If you patched the original symlink issue and considered it closed, revisit that assumption.

⚠️ Actively exploited — CVE-2026-0770 | Langflow | CVSS: N/A
Langflow, the popular AI workflow builder, contains an untrusted control sphere inclusion flaw enabling remote code execution without authentication. AI development tooling increasingly lives adjacent to sensitive models and data pipelines — exposure here can mean more than a compromised server. CISA deadline was July 24; patch immediately.

⚠️ Actively exploited — CVE-2021-27137 | DD-WRT | CVSS: N/A
A five-year-old stack-based buffer overflow in DD-WRT's UPnP handler is now actively exploited, allowing unauthenticated attackers to trigger code execution. The fact that a 2021 CVE is hitting the KEV list in 2026 is a reminder that consumer and prosumer router firmware rarely gets updated in the field. If DD-WRT devices sit on your network perimeter, check firmware versions now.

CVE-2026-7187 | Universal Software Inc. UKBS | CVSS: 8.8
Missing authentication for a critical function allows access to functionality not constrained by ACLs. The concerning detail: the vendor was contacted and confirmed the product is no longer supported. No patch is coming. Any organisation still running UKBS needs to isolate or decommission it immediately.

CVE-2026-15992 | WP Password Policy Plugin (WordPress, ≤3.7.1) | CVSS: 8.8
Missing authorisation checks and absent nonce verification in the get_user() function of the Module_Password_Hint class allow an attacker to call WP_User::set_role() with an arbitrary role on any account, resolved purely via a POST parameter. Unauthenticated privilege escalation to admin on any WordPress site running this plugin. Update to 3.7.2 or later.

CVE-2026-49332 | OpenShift oauth-proxy | CVSS: 8.5
The proxy correctly sets identity headers using dash-variant keys (e.g., X-Forwarded-User) but fails to strip underscore-variant equivalents (X_Forwarded_User) from incoming requests. Since WSGI and PHP frameworks normalise both to the same variable, an authenticated low-privilege user can smuggle a forged identity header and potentially override the legitimate user context downstream. A subtle but exploitable header smuggling issue in a widely deployed Kubernetes authentication component.

Headline News

The "Certighost" Active Directory Certificate Services Flaw
Microsoft's July patch cycle addressed a significant Active Directory Certificate Services vulnerability dubbed Certighost, which allowed a low-privilege domain user to obtain a valid Domain Controller certificate through AD CS misconfigurations. Possession of a DC certificate has severe consequences — it can be used to impersonate domain controllers, enabling Kerberos-based attacks including DCSync, which allows an attacker to extract password hashes for the entire domain. The technique builds on a well-understood class of AD CS abuse that has been weaponised by ransomware operators and nation-state actors alike since the ESC attack paths were documented. Organisations running AD CS in default or loosely configured deployments should apply the July updates, audit certificate templates for dangerous enrollment permissions, and review which low-privilege accounts can request certificates.

Malware Delivered via Steam Community Maps — Again
Attackers compromised community map files for Meccha Chameleon — a multiplayer title that moved 15 million copies in its first month — using them as Trojan horses to deliver malware to players who downloaded user-generated content. The technique mirrors earlier supply-chain-style attacks against Steam community content, where the trust users place in workshop downloads is exploited to bypass typical download warnings. For security practitioners, the incident reinforces that gaming platforms now represent a meaningful consumer-facing malware distribution surface, particularly relevant in environments where personal and work devices share network access or credentials. The scale of Meccha Chameleon's player base makes the potential exposure significant, and defenders should treat the Steam workshop ecosystem with the same scepticism applied to any third-party software repository.

AI-Assisted Vulnerability Research Is Doubling CVE Volume
The pace of CVE disclosures in 2026 is on track to roughly double 2025's total, with AI-assisted research tools being credited as a primary driver. Apple's most recent OS release notes explicitly credit Claude, Codex, and other AI tools for identifying vulnerabilities included in the patch batch — a notable shift from AI being an attack enabler to a fixture of defensive research workflows. The volume increase creates real pressure on patch management operations: more CVEs per cycle means more triage, more testing, and more difficult prioritisation decisions, even before considering active exploitation. For teams already stretched thin, the implication is that AI needs to be on both sides of the equation — not just finding bugs, but helping automate the downstream triage and response workflow too.

Schrödinger's Feed

Riverlane and the Unitary Foundation have launched the Deltakit Community Fund, aimed at accelerating open-source development of quantum error correction tooling — the unglamorous but foundational problem that stands between today's noisy qubits and cryptographically relevant quantum computers. Error correction is the critical bottleneck: without it, quantum systems make too many mistakes to run the deep circuits required to threaten RSA or ECC at practical key sizes. Open-sourcing this layer is a meaningful move, as it lowers the barrier for researchers worldwide to contribute to (and audit) the techniques that will eventually determine when "harvest now, decrypt later" attacks become viable. Practitioners planning post-quantum migration timelines should treat progress in error correction as a leading indicator — when this problem gets solved at scale, the urgency dial moves sharply.

/dev/random

Anthropic published research this week detailing how Claude was used to autonomously discover cryptographic weaknesses — not by brute force, but by reasoning about protocol structure and identifying logical flaws in implementation patterns. The model flagged vulnerabilities in cryptographic code that standard static analysis tools had missed, apparently by treating the problem more like a mathematician than a fuzzer. It's either reassuring or mildly unsettling that the same model you might ask to write a bedtime story can also audit your elliptic curve implementation. Security teams doing cryptographic code review may want to add "ask the chatbot" to their methodology — apparently it's doing peer review now.