cybr.cx Daily Digest — July 18, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-58644 | Microsoft SharePoint | No CVSS in KEV data (critical)
Microsoft SharePoint is under active attack via a deserialization of untrusted data vulnerability that enables unauthenticated remote code execution over a network. CISA's patch deadline was yesterday — if you haven't applied the fix, assume exposure. SharePoint-facing internet infrastructure should be treated as compromised until patched and audited.

⚠️ Actively exploited — CVE-2026-56164 | Microsoft SharePoint Server | No CVSS in KEV data (critical)
A separate SharePoint flaw involving missing authentication for a critical function allows unauthenticated privilege escalation over a network. Combined with CVE-2026-58644, Microsoft SharePoint is facing a two-vector active exploitation campaign — prioritise isolation or emergency patching of all SharePoint instances immediately.

⚠️ Actively exploited — CVE-2026-25089 & CVE-2026-39808 | Fortinet FortiSandbox | No CVSS in KEV data (critical)
Two OS command injection vulnerabilities in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS are being actively exploited by unauthenticated attackers via crafted HTTP requests. The fact that your sandbox environment is itself the attack surface here is operationally significant — detections from these appliances should be treated with elevated suspicion during the remediation window.

⚠️ Actively exploited — CVE-2026-46817 | Oracle E-Business Suite (Payments module) | No CVSS in KEV data (critical)
An improper privilege management flaw allows unauthenticated HTTP access to fully compromise Oracle Payments. CISA's due date was today. Organisations running Oracle EBS for financial operations should treat this as an emergency — full payment module takeover is the documented worst-case outcome.

⚠️ Actively exploited — CVE-2026-15409 & CVE-2026-15410 | SonicWall SMA1000 Appliances | No CVSS in KEV data (critical)
An SSRF and a code injection vulnerability in SonicWall's SMA1000 are being exploited in tandem — the SSRF is unauthenticated, while the command injection requires authenticated admin access, suggesting a chained attack path. Both had CISA remediation deadlines of July 17th. Remote access appliances being targeted at the edge remains a persistent and high-value threat pattern.

⚠️ Actively exploited — CVE-2026-56155 | Microsoft Active Directory Federation Services | No CVSS in KEV data (high)
An insufficient access control granularity bug in AD FS allows local privilege escalation. Active exploitation of identity federation infrastructure is particularly dangerous given its role in SSO chains — a compromised AD FS server can pivot into virtually any downstream application trust.

⚠️ Actively exploited — CVE-2008-4128 | Cisco IOS 12.4 | No CVSS in KEV data
Yes, you read the year correctly. A pair of CSRF vulnerabilities in Cisco IOS 12.4 — originally disclosed in 2008 — are actively being exploited in 2026. Attackers can execute arbitrary commands via crafted URIs targeting privileged exec paths. If you have legacy IOS 12.4 devices anywhere in your environment, they are being actively hunted.

⚠️ Actively exploited — CVE-2023-4346 | KNX Protocol (Connection Authorization Option 1) | No CVSS in KEV data
An overly restrictive account lockout mechanism in the KNX building automation protocol allows attackers to purge all devices and lock them with a BCU key — effectively bricking connected hardware. OT and building management teams should verify whether any KNX deployments lack additional security options enabled.

CVE-2026-14499, CVE-2026-7667, CVE-2026-7755, CVE-2026-8056 | IBM Langflow OSS 1.0.0–1.10.x | CVSS 8.8 HIGH
IBM's Langflow AI workflow platform has four serious vulnerabilities published in a single 24-hour window. CVE-2026-14499 enables authenticated users to execute arbitrary commands with elevated privileges via the Python Interpreter component. CVE-2026-7667 allows arbitrary file writes via a malicious flow pointing to an attacker-controlled URL with a path-traversal Content-Disposition header. CVE-2026-7755 enables remote code execution through incomplete validation of MCP server configuration files. CVE-2026-8056 allows runtime parameter override via the API, bypassing filtering in the apply_tweaks() function. Any Langflow deployment exposed beyond a single trusted user should be considered a high-priority patching target; update to 1.10.2 or later and audit flow configurations for unexpected external URLs.

CVE-2026-62203, CVE-2026-62207, CVE-2026-62228 | OpenClaw (before 2026.6.5/6.6) | CVSS 8.8 HIGH
Three closely related authorisation and privilege escalation flaws affect OpenClaw's host exec and node exec subsystems. Lower-trust callers can bypass admin-scoped tool restrictions, execute persisted actions beyond their authorisation level, or exploit mismatched gateway/node environment configurations to escape their approved permission set. Organisations using OpenClaw in multi-tenant or shared-access configurations should treat these as critical and upgrade immediately.

CVE-2026-62231 | Grav API Plugin (getgrav/grav-plugin-api before 1.0.6) | CVSS 8.1 HIGH
API keys issued with restricted scopes in the Grav CMS API plugin are not actually enforced — the ApiKeyAuthenticator class loads the full owner account object and ignores scope restrictions entirely. A read-only API key can perform administrative writes and deletes. Any externally issued or third-party Grav API key should be treated as fully privileged until the plugin is updated to 1.0.6.

Headline News

AI-assisted vulnerability discovery delivers Microsoft's largest-ever Patch Tuesday

Microsoft's July 2026 Patch Tuesday landed with 570 security fixes for Windows 11 — more than double the previous record and a direct result of the company's scaled deployment of AI-driven code analysis across its codebase. The volume is significant not just as a headline figure but as an indicator of how much latent vulnerability surface existed in mature, long-shipping software. For practitioners, the immediate implication is patch prioritisation under real operational pressure: standard 30-day patch cycles were not designed for this throughput. Several of the fixes correspond to vulnerabilities already appearing in the KEV catalogue above, underscoring that the gap between patch availability and active exploitation continues to compress. Security teams should cross-reference this month's advisory list against the KEV entries and triage accordingly, with SharePoint and AD FS patches treated as day-zero priorities.

AI auditing of a ZkVM uncovers meaningful cryptographic implementation flaws

A collaborative audit using AI-assisted analysis surfaced multiple bugs in OpenVM's zero-knowledge virtual machine implementation — a system designed to generate cryptographic proofs of computational correctness. The findings are notable because zkVM bugs don't just expose data: they can allow incorrect computations to be proven valid, undermining the entire integrity guarantee the system exists to provide. The audit identified issues in constraint logic and arithmetic circuit implementation — the kind of subtle, mathematically precise errors that are notoriously difficult to catch through conventional review. As ZK-proof systems migrate from experimental cryptography into production infrastructure for blockchain systems, identity verification, and privacy-preserving computation, the attack surface they introduce is poorly understood by most security teams. This work is a useful signal that AI-augmented formal analysis is beginning to mature as a practical auditing methodology for high-assurance cryptographic code.

HTTP/2 flow-control stall vulnerability exposes wide range of server implementations

CERT published VU#885548, documenting a denial-of-service vulnerability affecting HTTP/2 server implementations that can be triggered by stalled flow-control conditions — essentially, an attacker can manipulate the HTTP/2 flow-control window to freeze server-side request processing without completing or closing the connection. The vulnerability echoes the class of issues seen in earlier HTTP/2 rapid-reset attacks and affects a broad range of both open-source and commercial products, with vendor statements still being collected. Unauthenticated DoS against web-facing infrastructure via a protocol-level mechanism is straightforward to weaponise and difficult to distinguish from legitimate slow clients. Operators should review their HTTP/2 server software against the CERT advisory's vendor list and apply mitigations or updates as they become available.

Schrödinger's Feed

The current landscape of quantum computing research is consolidating fast: institutions are racing to move from qubit count demonstrations toward fault-tolerant, error-corrected systems — the threshold at which cryptographically relevant attacks on RSA and elliptic-curve schemes become theoretically feasible. The 2026 research rankings reflect heavy investment in both hardware (superconducting and photonic approaches) and algorithm development that narrows the timeline estimates practitioners have been relying on for PQC migration planning. NIST's finalised PQC standards exist, but enterprise adoption is moving slower than the research curve. Practitioners should treat any internal "we have years before this matters" assumptions as requiring active re-evaluation against the current pace of progress — the comfortable margin is shrinking.

/dev/random

Someone has written a Linux X server — a fully functional graphical display server — in pure x86 assembly language. Not as a research exercise or a minimal stub, but as an actual working implementation called Frame that can serve as a drop-in for basic X11 needs. The codebase is exactly what you'd expect: dense, unforgiving, and deeply satisfying to anyone who has ever argued that modern software stacks are over-engineered. It's a useful reminder that the abstraction layers we treat as mandatory infrastructure are, at their core, just choices — and that somewhere out there, someone is always choosing the hard way on purpose.