Threat Library

CVE-2026-39808 is an unauthenticated OS command injection vulnerability in Fortinet FortiSandbox, added to CISA's Known Exploited Vulnerabilities catalog with a short remediation window (added 2026-07-16, due 2026-07-19), indicating active exploitation in the wild. Attackers can send crafted HTTP requests to execute arbitrary commands without authentication, potentially gaining full control of the appliance.

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

Zoom has disclosed a critical vulnerability affecting its desktop client and software development kit (SDK) for Windows that could allow an unauthenticated attacker to hijack user accounts. No public exploitation has been reported yet, but the severity rating indicates high risk if a working exploit emerges. Organizations using Zoom on Windows endpoints should prioritize patching.

CISA has confirmed active exploitation of three SharePoint Server on-premises vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) allowing remote code execution, IIS machine key theft, and deserialization-based persistence. Two additional unexploited CVEs (CVE-2026-55040, CVE-2026-58644) have also been disclosed by Microsoft as high-risk if unpatched. All supported on-premises SharePoint versions are affected, prompting CISA to mandate emergency patching under its KEV catalog.

ABB disclosed four vulnerabilities in T-MAC Plus 4.0-24, a Terminal Management System used in chemical, petroleum, and bulk terminal operations. The most severe issue (CVSS 9.9) allows authenticated users to exfiltrate sensitive files via crafted HTTP GET requests due to IIS misconfiguration, while other flaws enable privilege escalation, stored XSS, and physical-access-based denial of service against Card Reader services. ABB has released version 4.0-25 to remediate all four issues.

A flaw in Symfony's fix for CVE-2024-50340 fails to properly prevent attacker-controlled environment flags from reaching the application via a discrepancy between parse_str() and the web SAPI's handling of $_GET. This allows remote attackers to craft query strings that manipulate $_SERVER['argv'] to inject --env or --no-debug flags, potentially flipping an application into debug mode or altering its environment configuration. Given the 9.8 CVSS score, this is a critical, low-complexity, remotely exploitable issue affecting a widely used PHP framework.

A flaw in Symfony's OidcTokenHandler::verifyClaims() fails to enforce mandatory audience, issuer, and expiry claims when validating JWTs, allowing a validly signed but incomplete token to bypass verification. This could let an attacker with any validly signed JWT (potentially from an unrelated issuer or expired context) authenticate as a legitimate user against affected Symfony applications. The issue is fixed in Symfony 6.4.40, 7.4.12, and 8.0.12.

A critical authentication bypass vulnerability affects Symfony's X509Authenticator component, where an unanchored regex used to parse client certificate distinguished names (DN) can be exploited by an attacker holding any trusted certificate. By embedding 'emailAddress=victim' within an unexpected RDN field like CN, an attacker can impersonate any user identified by email in a mutual TLS authentication scheme.

CVE-2026-58644 is a critical unauthenticated remote code execution vulnerability in Microsoft Office SharePoint caused by unsafe deserialization of untrusted data. An attacker can exploit this over the network without authentication to achieve full code execution on the SharePoint server, posing severe risk to any organization hosting on-premises SharePoint. Given the CVSS score of 9.8, this vulnerability is likely to be rapidly weaponized following disclosure.

n8n-MCP, an MCP server exposing n8n workflow automation to AI assistants, failed to isolate workflow version history backups between tenants when multi-tenancy was enabled. Any authenticated tenant could read, delete, or destroy other tenants' backup snapshots, which contained full node definitions, credential references, and authorization headers. This is a severe cross-tenant data exposure and destruction flaw fixed in version 2.56.1.

Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.

Cursor's browser-enabled Cloud Agent exposed a local agent control endpoint without authentication, allowing malicious web content encountered by the agent's browsing capability to reach it from inside the sandbox. This let attacker-controlled pages trigger code execution within the agent's session and steal repository files, environment variables, credentials, and GitHub App tokens. The vendor fixed the issue by requiring authentication on the endpoint.

SAP has patched a critical out-of-bounds write vulnerability (CVE-2026-44747, CVSS 9.9) in NetWeaver Application Server ABAP that allows an authenticated attacker to trigger memory corruption, potentially exposing or modifying sensitive business data. The flaw was addressed as part of SAP's July 2026 security update cycle alongside other vulnerabilities.

Microsoft's July 2026 Patch Tuesday addressed 622 CVEs, its largest release on record and more than triple the prior high, including two zero-day vulnerabilities confirmed to be under active exploitation. The advisory was informed by incident responders, indicating real-world attack activity preceded the patches. Organizations should prioritize immediate patching given the scale of the release and confirmed in-the-wild abuse.

SonicWall has disclosed that two vulnerabilities in its SMA1000 Secure Mobile Access appliances are being actively exploited as zero-days. The company has released security updates and is urging all customers to patch immediately to prevent further compromise.

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, affecting SonicWall SMA1000 appliances (SSRF and code injection) and Microsoft Active Directory Federation Services and SharePoint Server (access control and authentication bypass issues). These flaws are being actively exploited in the wild and pose significant risk to federal and enterprise networks, with BOD 26-04 mandating rapid remediation for FCEB agencies.

Apache Kylin versions 4 through 5.0.3 contain a critical OS command injection vulnerability where backend API job configuration parameters are passed unsanitized to the OS command line, allowing attackers to execute arbitrary commands on the host. With a CVSS score of 9.8, this flaw poses severe risk to any organization running affected Kylin instances, particularly those exposed to untrusted networks. Users should upgrade immediately to version 5.0.4, which resolves the issue.

A critical SQL injection vulnerability (CVE-2026-62390) affects Apache Kylin versions 4 through 5.0.3, stemming from improper neutralization of special elements in a backend API that refreshes the table catalog. Successful exploitation could allow attackers to manipulate generated SQL queries, potentially leading to unauthorized data access, modification, or full database compromise. Users should upgrade to version 5.0.4 to remediate the issue.

Apache Doris versions prior to 3.1.0 expose Frontend (FE) HTTP REST administrative APIs without proper authentication enforcement, allowing unauthenticated network attackers to perform privileged administrative operations. This can lead to cluster instability, unauthorized configuration changes, or denial of service against the analytics cluster.

CVE-2026-56164 is a missing authentication for critical function vulnerability in Microsoft SharePoint Server that allows an unauthorized, remote attacker to elevate privileges over the network. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog with an aggressive three-day remediation deadline, indicating active exploitation in the wild. Organizations running on-premises SharePoint Server deployments should treat this as an urgent patching priority.