Weekly Cyberattack Roundups

Weekly Cyberattack Roundup: Confirmed Active Exploitation and Defensive Priorities, July 13–19, 2026

Multiple enterprise technology paths showing confirmed exploitation signals across collaboration, identity, payments, security appliances, remote access, and legacy network infrastructure
Weekly Cyberattack Roundups
Last fact-checked July 2026
Analysis by Ali Hassani, CISO

This weekly review focuses on a fact pattern defenders can verify: vulnerabilities added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog between July 13 and July 19, 2026.

CISA added ten vulnerabilities affecting SharePoint, Active Directory Federation Services, Oracle E-Business Suite, FortiSandbox, SonicWall SMA1000 appliances, KNX building-automation technology, and legacy Cisco IOS. Inclusion in the catalog means CISA has evidence of exploitation in the wild. It does not establish which organizations were affected, how many incidents occurred, who exploited each weakness, or whether ransomware was involved.

Executive summary

  • Ten vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog during the covered week.
  • Affected technology areas: collaboration servers, federation infrastructure, enterprise payments, security-analysis appliances, remote-access appliances, building automation, and legacy network devices.
  • Most urgent business question: not “How high is the CVSS score?” but “Do we operate an affected version, is it exposed, and what evidence should we preserve before and after remediation?”
  • Ransomware status: CISA listed known ransomware-campaign use as Unknown for all ten entries at the time of review.
  • No victim claims: this roundup does not identify affected organizations because the catalog entries and vendor advisories do not support that conclusion.

The week at a glance

Date added Vulnerability Affected technology CISA due date Known ransomware use
July 13 CVE-2008-4128 Cisco IOS 12.4 July 16 Unknown
July 14 CVE-2026-56155 Microsoft AD FS July 28 Unknown
July 14 CVE-2026-56164 Microsoft SharePoint Server July 17 Unknown
July 14 CVE-2026-15409 SonicWall SMA1000 July 17 Unknown
July 14 CVE-2026-15410 SonicWall SMA1000 July 17 Unknown
July 15 CVE-2023-4346 KNX Protocol, Connection Authorization Option 1 July 29 Unknown
July 15 CVE-2026-46817 Oracle E-Business Suite, Oracle Payments July 18 Unknown
July 16 CVE-2026-25089 FortiSandbox / related offerings July 19 Unknown
July 16 CVE-2026-39808 FortiSandbox July 19 Unknown
July 16 CVE-2026-58644 Microsoft SharePoint July 19 Unknown

The dates above come from CISA’s machine-readable KEV catalog. CISA deadlines directly govern Federal Civilian Executive Branch agencies; other organizations can use them as a strong urgency signal while applying their own risk and change-control decisions.

Collaboration infrastructure: two SharePoint vulnerabilities

CVE-2026-56164

CISA describes CVE-2026-56164 as a missing-authentication weakness in Microsoft SharePoint Server that can allow an unauthorized attacker to elevate privileges over a network. The entry was added July 14 with a July 17 remediation due date. Microsoft’s security update entry is the authoritative vendor source for affected versions, updates, and revisions.

CVE-2026-58644

CISA describes CVE-2026-58644 as deserialization of untrusted data in Microsoft SharePoint that can allow an unauthorized attacker to execute code over a network. It was added July 16 with a July 19 due date. Administrators should use Microsoft’s CVE-2026-58644 advisory rather than relying on a third-party version list.

Defensive priority: Inventory every on-premises SharePoint farm, internet-facing endpoint, management path, service account, and trust relationship. Confirm the installed build, apply Microsoft’s instructions, and review relevant web, authentication, process, and endpoint telemetry for activity that predates the patch. A successful update closes a vulnerability; it does not prove the server was never accessed.

Identity infrastructure: AD FS privilege elevation

CISA added CVE-2026-56155, an Active Directory Federation Services access-control weakness that can allow an authorized attacker to elevate privileges locally. Microsoft’s vendor advisory should determine affected versions and remediation.

Organizations that still operate AD FS should treat it as identity infrastructure, not an ordinary Windows server. Review administrator access, service accounts, token-signing and token-decrypting certificate protection, federation configuration, host telemetry, and changes to trust relationships. Where AD FS no longer supports a current business requirement, Microsoft maintains an official AD FS decommissioning guide.

Defensive priority: Patch supported systems, preserve logs, validate federation configuration, investigate unexpected privileged activity, and document whether the platform remains necessary.

Enterprise payments: Oracle E-Business Suite

CISA describes CVE-2026-46817 as an improper privilege-management vulnerability in Oracle E-Business Suite that can allow an unauthenticated attacker with network access over HTTP to compromise Oracle Payments. It was added July 15 with a July 18 due date. Oracle’s May 2026 Critical Patch Update material is the controlling vendor reference.

Because the affected component supports payment activity, the review should involve security, application administration, finance, and internal audit. Teams should identify affected instances, exposure paths, privileged changes, unusual payment configuration activity, and the integrity of approval workflows.

Defensive priority: Follow Oracle’s remediation instructions, limit network reachability, review relevant application and database evidence, and validate payment master-data and workflow integrity.

Security-analysis infrastructure: FortiSandbox

CISA added two FortiSandbox command-injection vulnerabilities on July 16:

  • CVE-2026-25089: CISA says an unauthenticated attacker can execute unauthorized commands through crafted HTTP requests. See Fortinet’s FG-IR-26-141 advisory.
  • CVE-2026-39808: CISA says an unauthenticated attacker can execute unauthorized code or commands through crafted HTTP requests. See Fortinet’s FG-IR-26-100 advisory.

A security appliance can be a high-value target because it may have privileged network visibility, receive untrusted files, and integrate with other controls. Patch status should therefore be paired with configuration review, management-plane exposure assessment, credential rotation when supported by evidence, and inspection of appliance and downstream logs.

Defensive priority: Confirm the exact product and service model, follow the applicable vendor action, restrict management access, preserve evidence, and validate integrations after remediation.

Remote access: SonicWall SMA1000

CISA added:

  • CVE-2026-15409, a server-side request forgery weakness that can cause the appliance to make requests to unintended locations; and
  • CVE-2026-15410, a command-injection weakness that CISA says can allow a remote authenticated administrator to execute operating-system commands under specific conditions.

Both entries refer to SonicWall’s SNWLID-2026-0008 advisory.

Remote-access systems sit near the boundary between the internet and internal services. Administrators should validate versions and hotfixes, review privileged sessions and configuration changes, restrict management interfaces, and assess whether downstream credentials or tokens require additional action based on evidence.

Defensive priority: Apply vendor mitigation, examine administrator activity and appliance telemetry, and confirm that remote-access functionality and security controls operate normally after the change.

Building automation: KNX protocol

CISA added CVE-2023-4346, which affects KNX Protocol Connection Authorization Option 1. CISA says the weakness can allow an attacker to purge devices that lack additional security options and set a key that locks the device. The catalog points to CISA’s original industrial-control-system advisory.

This entry is a reminder that operational and building systems may be managed by facilities teams, integrators, or vendors rather than central IT. Inventory must cross those organizational boundaries. Owners should determine whether affected KNX implementations exist, which security options are enabled, who can reach the management path, and how configuration recovery would work.

Defensive priority: Coordinate with the system integrator or vendor, protect management access, maintain recoverable configuration records, and avoid untested changes to safety- or facility-critical systems.

Facilities and cybersecurity specialists validating a segmented KNX building-automation gateway in a commercial mechanical room
Building-automation remediation should confirm controller inventory, gateway segmentation, physical operations, current vendor guidance, and safe manual procedures.

Legacy network infrastructure: Cisco IOS 12.4

CISA added CVE-2008-4128, a cross-site request forgery weakness affecting Cisco IOS 12.4, on July 13. The catalog’s vendor link points to Cisco’s obsolete IOS 12.4 release page.

The age of the CVE is operationally important. An actively exploited vulnerability from 2008 appearing in 2026 should trigger an asset-lifecycle question, not only a patch ticket. If unsupported hardware or software cannot receive a dependable vendor fix, isolation and compensating controls may reduce exposure temporarily, but replacement planning is the sustainable response.

Defensive priority: Find affected devices, remove unneeded HTTP management, restrict management sources, follow available vendor guidance, and replace unsupported infrastructure on a risk-based schedule.

What is confirmed—and what is not

Confirmed by CISA: Each listed CVE had evidence of active exploitation sufficient for addition to the KEV catalog.

Not established by the catalog: victim identities, incident counts, threat-actor identity, attacker motivation, exploitation success in a particular organization, data loss, operational impact, or ransomware involvement.

Ransomware field: CISA marked known ransomware-campaign use as “Unknown” for all ten entries. “Unknown” is not evidence for or against ransomware; it means the catalog did not establish that relationship at the time reflected in the feed.

A practical 24-hour response

  1. Establish ownership: Assign one accountable owner for each affected technology family.
  2. Find the assets: Query configuration management, vulnerability, cloud, network, directory, procurement, and facilities records.
  3. Confirm versions: Use vendor-supported methods; do not rely only on product banners or stale inventory.
  4. Assess reachability: Document internet exposure, management access, trusted networks, application paths, and external support channels.
  5. Preserve evidence: Retain relevant logs and volatile evidence before disruptive remediation when compromise is plausible.
  6. Apply vendor action: Patch, mitigate, isolate, or discontinue use as directed by the vendor and organizational risk owners.
  7. Validate: Re-scan or verify versions, test business functionality, review telemetry, and close only with evidence.
  8. Escalate exceptions: Any system that cannot be remediated needs a named owner, compensating controls, deadline, and accepted residual risk.

For the broader decision model behind this weekly review, read How to Prioritize CISA Known Exploited Vulnerabilities. Implementation teams can then use OC Security Audit’s guidance on CVSS, EPSS, and KEV vulnerability prioritization and remediation SLAs and rescanning.

Make the weekly review operational

A weekly intelligence meeting should produce a short, auditable output:

  • affected assets confirmed or ruled out;
  • exposure and business criticality;
  • remediation or mitigation status;
  • evidence reviewed for possible exploitation;
  • exceptions and accountable owners;
  • recovery or replacement work required; and
  • the date of verification.

If your organization needs an independent review of its vulnerability-prioritization and validation process, contact OC Security Audit. This roundup was prepared and reviewed by Ali Hassani, CISO.

Primary sources

Coverage window: July 13–19, 2026. Last fact-checked July 2026. Vendor advisories and CISA entries can change; verify the current source before acting.