cybr.cx — Daily Cybersecurity Intelligence Digest

July 16, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-56164 | Microsoft SharePoint Server
CVSS: N/A (KEV-listed) | No authentication required. An unauthenticated network attacker can exploit a missing authentication check to elevate privileges on SharePoint Server. CISA's remediation deadline was yesterday (July 17) — if you haven't patched, treat this as an emergency. SharePoint's attack surface in enterprise environments makes this a high-value target for initial access.

⚠️ Actively exploited — CVE-2026-46817 | Oracle E-Business Suite (Payments module)
CVSS: N/A (KEV-listed) | An unauthenticated attacker with HTTP network access can fully compromise Oracle Payments via an improper privilege management flaw. Complete takeover of the payments component is the stated impact. CISA's patch deadline is July 18 — one day away. Organisations running EBS for financial processing should deprioritise everything else right now.

⚠️ Actively exploited — CVE-2026-56155 | Microsoft Active Directory Federation Services
CVSS: N/A (KEV-listed) | An authorised attacker can locally escalate privileges due to insufficient access control granularity in AD FS. Given AD FS's role as the trust broker for federated identity, privilege escalation here can cascade across every service relying on it. Patch deadline is July 28, but given active exploitation, don't wait.

⚠️ Actively exploited — CVE-2026-15409 & CVE-2026-15410 | SonicWall SMA1000 Appliances
CVSS: N/A (KEV-listed) | Two actively exploited flaws in SonicWall's SMA1000 appliances — a server-side request forgery (CVE-2026-15409) enabling unauthenticated attackers to force the device to make arbitrary outbound requests, and a code injection flaw (CVE-2026-15410) allowing authenticated admins to execute OS commands. CISA's deadline for both was July 17. SMA appliances sit at the network perimeter; SSRF plus RCE is a brutal combination.

⚠️ Actively exploited — CVE-2023-4346 | KNX Protocol (Building Automation)
CVSS: N/A (KEV-listed) | An overly restrictive account lockout mechanism in the KNX Protocol's Connection Authorization Option 1 can be abused to purge all devices on a KNX network and set a BCU key, effectively bricking connected building systems. This is an OT/ICS vulnerability affecting building automation (lighting, HVAC, access control) and its appearance in KEV should alarm critical facility operators. Patch deadline July 29.

⚠️ Actively exploited — CVE-2008-4128 | Cisco IOS 12.4
CVSS: N/A (KEV-listed) | Yes, 2008. Multiple CSRF vulnerabilities in Cisco IOS 12.4 allow remote attackers to execute arbitrary commands via crafted requests to the HTTP management interface. The fact that this nearly 18-year-old CVE is seeing active exploitation in 2026 tells you exactly how many legacy routers are still running in production. CISA's remediation deadline was today — upgrade or take the management interface offline.

CVE-2026-60005 | NGINX Plus and NGINX Open Source
CVSS: 8.2 — HIGH | A flaw in the ngx_http_slice_module triggers uninitialized memory access when the slice directive is used with unnamed regex captures, or during background cache updates. An unauthenticated attacker can send crafted requests to cause limited memory disclosure or force a worker process restart. If you're running NGINX with caching and slice directives, this is a meaningful availability and information-disclosure risk — check your configs and patch promptly.

CVE-2026-57996 | phpMyFAQ < 4.1.5
CVSS: 8.8 — HIGH | A delegated administrator with user management permissions can call the /admin/api/user/add endpoint with isSuperAdmin: true to silently create a full SuperAdmin account. This is a classic broken access control issue — privilege boundaries enforced in the UI simply aren't enforced in the API. Upgrade to 4.1.5 immediately.

CVE-2026-58659 | PyTorch Lightning ≤ 2.6.5
CVSS: 7.8 — HIGH | Maliciously crafted checkpoint files can embed attacker-controlled module names in _instantiator hyperparameters that are imported and executed at load time, bypassing weights_only=True protections. Any ML pipeline that loads checkpoints from untrusted sources — including shared model repositories — is at risk. Fixed in commit d710d68; update your dependencies and validate checkpoint provenance.

CVE-2026-12997 | Gravity Forms for WordPress ≤ 2.10.4
CVSS: 7.5 — HIGH | Unauthenticated directory traversal via the gform_uploaded_files parameter allows arbitrary file reads on the server when the targeted form is publicly accessible (no login enforcement). On a typical WordPress installation this could expose credentials, configuration files, or application secrets. Over 900,000 active installs make this a high-volume target — patch immediately.

Headline News

Microsoft's July Patch Tuesday Is Genuinely Historic — and Actively Dangerous

Microsoft's July 2026 Patch Tuesday landed with 622 CVEs addressed in a single release — more than triple June's then-record count of around 206. Of those, 57 are rated Critical, and two are confirmed zero-days already under active exploitation in the wild: CVE-2026-56164 (SharePoint Server, unauthenticated privilege escalation) and CVE-2026-56155 (AD FS, local privilege escalation), both of which appear in CISA's KEV catalog with imminent patch deadlines. The sheer volume is straining patching pipelines — security teams attempting to triage 622 CVEs in a standard change-management cycle are working against adversaries who are already exploiting the most critical ones. Practitioners should immediately prioritise the two KEV-listed zero-days and the 57 Critical-rated items, and treat the rest as a rolling backlog to be cleared under risk-based prioritisation.

Russian Threat Actors Continue Systematic Router Compromise Campaign

A coordinated multinational advisory has confirmed that Russian state-affiliated threat actors are actively and systematically targeting vulnerable routers — particularly legacy and unpatched devices — as a staging mechanism for intrusions into critical infrastructure networks. The campaign is not opportunistic; advisories indicate deliberate targeting of devices with known unpatched vulnerabilities, weak credentials, or unsupported firmware, consistent with establishing persistent footholds for long-term access. The relevance of CVE-2008-4128 appearing in CISA's KEV today is hard to ignore in this context — nearly two-decade-old Cisco IOS flaws being actively exploited suggests threat actors are specifically hunting for neglected infrastructure. Practitioners managing any legacy network equipment should treat router firmware updates and management interface exposure as immediate priorities, not scheduled maintenance.

Claude Memory Poisoning Enables Cross-User Data Exfiltration

A researcher demonstrated a practical attack chain against Anthropic's Claude that exploits the AI's persistent memory feature to exfiltrate sensitive data from other users. By crafting a malicious prompt that injects instructions into Claude's long-term memory store, an attacker can cause the model to silently include fragments of other users' private data in future responses — a form of indirect prompt injection with real privacy consequences. The attack required no special access or privileges, only the ability to interact with a shared Claude instance that has memory enabled. This is a significant demonstration of why persistent memory in multi-user or enterprise AI deployments represents a meaningful attack surface that currently lacks robust isolation guarantees — practitioners deploying shared LLM tooling internally should audit what memory persistence is enabled and for whom.

Schrödinger's Feed

QuSecure has listed its QuProtect R3 platform on the AWS Marketplace specifically targeting the U.S. Intelligence Community — a notable signal that post-quantum cryptography is transitioning from standards documents into active procurement at the highest-sensitivity tiers of government. QuProtect R3 is designed to provide a PQC overlay for existing network infrastructure, theoretically allowing agencies to begin hardening against harvest-now-decrypt-later threats without full infrastructure replacement. The marketplace listing means IC-adjacent contractors and cleared organisations can now procure PQC capabilities through an existing, vetted cloud acquisition channel. Practitioners managing long-lived encrypted data — anything that needs to remain confidential past the mid-2030s — should take note that the intelligence community's procurement posture signals the threat timeline is being treated as real and near.

/dev/random

Briar, the peer-to-peer encrypted messaging app beloved by activists and privacy researchers for its ability to route messages over Tor, Bluetooth, and Wi-Fi without any central server, has announced it is entering maintenance mode — meaning no new features, just security patches and critical fixes going forward. The project cited insufficient funding and contributor bandwidth, which is a recurring and somewhat grim theme for the open-source security tools that tend to matter most in high-stakes environments. The irony is that Briar's architecture — serverless, mesh-capable, genuinely decentralised — is precisely the kind of thing that becomes very hard to replace once it's gone. If you've ever recommended Briar to someone operating in a hostile communications environment, now would be a good time to check whether your contingency plan has a contingency.