NewsCompaniesFlawsGuides
Get the app

Flaws added in July 2026

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in July 2026. For the newest, see Exploited flaws.

In July 2026, CISA added 26 flaws to its list of vulnerabilities being used in attacks, 2 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Microsoft (5), Fortinet (3) and Cisco (2).[1]

Most let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in July 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

1 added

CVEFlawFound
CVE-2026-20316† Used in ransomwareAt work Cisco Secure Firewall Management Center (FMC). Attackers can use Cisco Secure Firewall Management Center (FMC) to take full control of the machine from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2026-16812At work Arista VeloCloud Orchestrator. Attackers can run commands on Arista VeloCloud Orchestrator. At work
CVE-2025-68686At work Fortinet FortiOS. Attackers can read information from Fortinet FortiOS that should be private from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2026-50522At work Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. At work
CVE-2026-16232At work Check Point SmartConsole. Attackers can get into Check Point SmartConsole without a valid password. At work

4 added

CVEFlawFound
CVE-2026-63030At home WordPress Core. Attackers can run their own code on WordPress Core. At home
CVE-2026-60137At home WordPress Core. Attackers can run their own code on WordPress Core from anywhere, without logging in. At home
CVE-2026-0770At work Langflow. Attackers can run their own code on Langflow. At work
CVE-2021-27137At work DD-WRT. Attackers can run their own code on DD-WRT from anywhere, without logging in. At work

3 added

CVEFlawFound
CVE-2026-58644At work Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. At work
CVE-2026-39808At work Fortinet FortiSandbox. Attackers can run commands on Fortinet FortiSandbox from anywhere, without logging in. At work
CVE-2026-25089At work Fortinet FortiSandbox. Attackers can run commands on Fortinet FortiSandbox from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2026-46817At work Oracle E-Business Suite. Attackers can reach parts of Oracle E-Business Suite that should be locked to them from anywhere, without logging in. At work
CVE-2023-4346At work KNX Association KNX Protocol Connection Authorization Option 1. Attackers are using a flaw in KNX Association KNX Protocol Connection Authorization Option 1. At work

4 added

CVEFlawFound
CVE-2026-56164At work Microsoft SharePoint Server. Someone who already has a foothold can use Microsoft SharePoint Server to take full control of the machine. At work
CVE-2026-56155At work Microsoft Active Directory Federation Services. Someone who already has a foothold can use Microsoft Active Directory Federation Services to take full control of the machine. At work
CVE-2026-15410† Used in ransomwareAt work SonicWall SMA1000 Appliances. Someone who already has a way in can use SonicWall SMA1000 Appliances to run their own code. At work
CVE-2026-15409† Used in ransomwareAt work SonicWall SMA1000 Appliances. Attackers can make SonicWall SMA1000 Appliances send requests into the network behind it from anywhere, without logging in. At work

1 added

CVEFlawFound
CVE-2008-4128At work Cisco IOS. Attackers can run commands on Cisco IOS. At work

2 added

CVEFlawFound
CVE-2026-56291At work Balbooa Forms. Attackers can upload a file to Balbooa Forms from anywhere, without logging in and make it run. At work
CVE-2026-48939At work iCagenda. Attackers can upload a file to iCagenda and make it run. At work

4 added

CVEFlawFound
CVE-2026-56290At work Joomlack Page Builder. Attackers can run their own code on Joomlack Page Builder from anywhere, without logging in. At work
CVE-2026-55255At work Langflow. Attackers can reach parts of Langflow that should be locked to them. At work
CVE-2026-48908At work JoomShaper SP Page Builder. Attackers can upload a file to JoomShaper SP Page Builder from anywhere, without logging in and make it run. At work
CVE-2026-48282At work Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion. At work

1 added

CVEFlawFound
CVE-2026-45659† Used in ransomwareAt work Microsoft SharePoint Server. Attackers can run their own code on Microsoft SharePoint Server. At work

Companies

The flaws were in 16 companies’ products; the most were in Microsoft’s (5).

CompanyFlawsRansomware
Microsoft51
Fortinet3–
Cisco21
Langflow2–
SonicWall22
WordPress2–
Adobe1–
Arista1–
Balbooa1–
Check Point1–
DD-WRT1–
iCagenda1–
Joomlack1–
JoomShaper1–
KNX Association1–
1 others1

Other months

Every month since CISA started the list; July 2026 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.