cybr.cx — Daily Digest | July 21, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-58644 | Microsoft SharePoint | No CVSS in NVD feed
A deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote attackers to execute arbitrary code over a network. CISA added this to the KEV catalogue on July 16 with a remediation deadline that has already passed — if you haven't patched, assume you're a target. SharePoint's attack surface makes this a priority for any enterprise environment.

⚠️ Actively exploited — CVE-2026-25089 & CVE-2026-39808 | Fortinet FortiSandbox
Two separate OS command injection vulnerabilities in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS both allow unauthenticated attackers to execute arbitrary OS commands via crafted HTTP requests. Both are KEV-listed as of July 16. The irony of your sandboxing product becoming an RCE entry point is not lost — patch immediately or isolate the management interface.

⚠️ Actively exploited — CVE-2026-56164 | Microsoft SharePoint Server
A missing authentication for critical function flaw allows unauthenticated network attackers to elevate privileges on SharePoint Server. Paired with CVE-2026-58644 above, SharePoint is having a genuinely bad month. KEV deadline was July 17 — already overdue.

⚠️ Actively exploited — CVE-2026-46817 | Oracle E-Business Suite (Payments module)
Improper privilege management allows unauthenticated HTTP attackers to fully compromise Oracle Payments. Full takeover of a payments module with no authentication required is about as bad as it gets for financial infrastructure. KEV deadline was July 18.

⚠️ Actively exploited — CVE-2026-15409 & CVE-2026-15410 | SonicWall SMA1000
An SSRF (CVE-2026-15409) and OS command injection (CVE-2026-15410) pair on SonicWall SMA1000 appliances — the SSRF is exploitable unauthenticated, while the command injection requires admin-level authentication. Together they represent a plausible chained attack path. Both are KEV-listed; remediation deadline was July 17.

⚠️ Actively exploited — CVE-2026-56155 | Microsoft Active Directory Federation Services
Insufficient access control in AD FS allows a locally authenticated attacker to elevate privileges. Less dramatic than the SharePoint flaws but critical in federated identity environments where AD FS underpins SSO for broad application access.

⚠️ Actively exploited — CVE-2023-4346 | KNX Protocol (Building Automation)
A three-year-old vulnerability in KNX Connection Authorization Option 1 is now KEV-listed, allowing attackers to purge devices and set BCU keys to lock them out — effectively bricking building automation hardware. If you manage OT or smart building environments, audit KNX exposure immediately.

⚠️ Actively exploited — CVE-2008-4128 | Cisco IOS 12.4
Yes, 2008. A CSRF pair in Cisco IOS 12.4 that allows remote command execution via crafted URIs has somehow landed on the 2026 KEV list. If you still have IOS 12.4 devices network-accessible, that's a larger problem than this single CVE.

CVE-2026-63090 | ProFTPD mod_sftp | CVSS 8.8
A heap-based buffer overflow in ProFTPD's mod_sftp module (versions before 1.3.9c / 1.3.10rc3) lets authenticated low-privilege users achieve arbitrary code execution by sending crafted SFTP packet fragments that overflow the 16 KB reassembly buffer in fxp.c. Any environment offering SFTP access to untrusted users — including shared hosting or developer platforms — should update immediately.

CVE-2026-63108 | Roo Code ≤ 3.54.0 | CVSS 8.8
A command injection flaw in the AI coding assistant Roo Code's auto-approve execute feature allows attackers to bypass allowlist/denylist controls by nesting command substitutions inside parameter expansion defaults. The parser in parse-command.ts creates opaque placeholders before scanning for dangerous constructs, meaning malicious commands slip through undetected. Given the tool's direct terminal access, exploitation is highly impactful.

CVE-2026-63735 & CVE-2026-63756 | SurrealDB | CVSS 8.1
Two separate high-severity issues in SurrealDB: one (before 3.2.0) fails to validate namespace and database scope in custom API routes, enabling authenticated cross-tenant data access; the other (before 3.1.0) is a TOCTOU race condition on the /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Multi-tenant SurrealDB deployments are particularly exposed — upgrade to 3.2.0.

CVE-2026-42533 | NGINX | Critical (patched July 15)
F5 patched a heap buffer overflow in NGINX's worker process triggerable by unauthenticated remote attackers via crafted HTTP requests. Fixed in stable 1.30.4 and mainline 1.31.3. Given NGINX's ubiquity as a reverse proxy and load balancer, this has a vast potential blast radius — check your versions now.

CVE-2026-14266 | 7-Zip ≤ 26.01 | RCE via malicious XZ archives
A heap-based buffer overflow when processing specially crafted XZ-compressed archives allows remote code execution if a user opens a malicious file. Fixed in 7-Zip 26.02. XZ files are common enough in developer and sysadmin workflows that drive-by delivery via email or download is a realistic vector.

Headline News

Romania's Land Registry Wiped in Destructive Cyberattack
A hacker has reportedly wiped the entirety of Romania's national land registry database — a system that underpins property ownership records for the entire country. The attack raises immediate concerns about data recovery, the availability and integrity of backups, and the potential for follow-on fraud given that property ownership records are now in question. Destructive attacks targeting government databases represent a different threat model than ransomware: rather than demanding payment for decryption, the goal appears to have been maximum disruption to critical civil infrastructure. For practitioners, this reinforces the case for immutable, air-gapped backup strategies for systems that are authoritative sources of record — restoring from a compromised or absent backup in this context could have years-long legal and civil consequences.

Researcher Finds $500K WordPress RCE for $25 Using GPT-5.6
A security researcher has published findings describing the discovery of a remote code execution vulnerability in WordPress — the kind that exploit brokers price at half a million dollars — using GPT-5.6 and approximately $25 in compute costs. The methodology involved AI-assisted code auditing to surface a flaw that manual review had apparently missed, completing in hours what might otherwise take weeks of dedicated research. The story has significant implications for the economics of vulnerability research: if capable AI models can compress the cost of finding critical RCEs by four to five orders of magnitude, the advantage historically held by well-resourced teams narrows considerably. Defenders should expect both the supply of discovered vulnerabilities and the speed of weaponisation to accelerate — the window between patch release and active exploitation is likely to shrink further.

Critical NGINX Heap Overflow Patched — Update Urgently
F5 shipped fixes for CVE-2026-42533, a critical heap buffer overflow in NGINX that can be triggered remotely and without authentication via malformed HTTP requests, potentially enabling code execution in the worker process. The flaw was patched on July 15 in both the stable (1.30.4) and mainline (1.31.3) branches. NGINX's role as the reverse proxy or load balancer in front of a significant proportion of internet-facing infrastructure means the exposure is exceptionally broad — including containerised environments where NGINX images may not be updated automatically. Organisations running self-managed NGINX deployments should treat this as a priority patch regardless of whether exploitation has been confirmed in their sector.

Schrödinger's Feed

New Mexico Bets $450M on Quantum Infrastructure
New Mexico has committed $450 million to a state quantum initiative, with Maybell Quantum establishing operations as part of the programme — a significant investment in the cryogenic and hardware layer that physical quantum systems depend on. Quantum computing's progress has historically been throttled by the extreme engineering challenges of maintaining near absolute-zero operating environments at scale, and dedicated regional infrastructure investments signal that the field is moving from lab curiosity to industrial buildout. For security practitioners, the timeline question is the critical one: sustained infrastructure investment of this scale tends to compress development timelines, and the cryptographic assumptions baked into today's deployed PKI have a finite shelf life. It's worth revisiting your organisation's post-quantum migration roadmap — NIST's finalised PQC standards give you the tools, but the window to deploy them is not infinite.

/dev/random

537,000 Domains in a $5 Chip
Someone has managed to fit a 537,000-domain blocklist onto an ESP32 microcontroller — a $5 piece of hardware with roughly 520 KB of usable RAM — and built a functioning DNS-based ad blocker that answers blocked queries in under 10 milliseconds, using only around 50 KB of RAM for the list itself. The trick involves a compressed trie data structure and some creative memory layout to pack what would normally require megabytes into a device that costs less than a cup of coffee. It's a genuinely impressive piece of embedded systems work, and a useful reminder that "not enough resources" is often an engineering problem rather than a hardware one. Pi-hole owners with a spare fiver and a soldering iron are presumably already reading the firmware repo.