Between the monthly briefs: vulnerabilities with a CVE that are on the CISA
KEV catalog or carry evidence of exploitation in the wild. This is the short list —
the things whose patch window has already closed.
As of 30 July 2026, 22:55 UTC ·
Source brief 2026-07-30Cadence updated weekdays
Patch priority — 12 under active exploitation
Ranked in from the brief. Every entry here has a CVE and either a CISA KEV
listing or independent evidence of exploitation.
CVE-2026-16232CVSS 9.1Exploited
Check Point — Security Management Server and Multi-Domain Security Management Server (MDS)
Authentication bypass — attacker-supplied SIC distinguished name accepted in place of the authenticated peer certificate identity (CWE-287)
Exploitationyes — CISA KEV-confirmed (added 2026-07-22, ransomware use: Unknown); Check Point states it is aware of exploitation affecting 'a very small number of customers', who were notified directly; Rapid7 Labs confirmed in-the-wild exploitation as a zero-day at disclosure and published a working PoC
KEV added2026-07-22
CISA deadline2026-07-25
Patched inJumbo Hotfix Accumulator: R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+ (Rapid7 confirmed R81.20 Take 146 vulnerable, Take 158 fixed). Affected list also includes R77.30, R80, R80.10, R80.20, R80.30, R81, R81.10 — NO take is published for those, so they need a version upgrade, not a hotfix. Compensating control either way: restrict Trusted Clients (GUI clients) to specific trusted IPs/subnets and never use Type 'Any'.
PTC Windchill PDMLink and FlexPLM (releases prior to 11.0 M030)
Deserialization of untrusted data (CWE-502/CWE-20) → unauthenticated RCE → JSP webshell → data theft + extortion
Exploitationyes — CISA-confirmed active exploitation, knownRansomwareCampaignUse: Known; assessed exploited as a zero-day from early June 2026, prior to the June 17 disclosure
KEV added2026-06-25
CISA deadline2026-06-28
Patched inPTC advisory June 2026; fixed in 11.0 M030 and later. Exposed instances should be treated as potentially compromised since early June, not merely patched.
Improper control of dynamically-managed code resources (CWE-913) in workflow expression evaluation → authenticated RCE as the n8n process
Exploitationyes — CISA KEV listing establishes confirmed in-the-wild exploitation (added 2026-03-11); knownRansomwareCampaignUse: Unknown, which is not a statement that exploitation is absent
KEV added2026-03-11
CISA deadline2026-03-25
Patched inFixed in n8n 1.120.4 / 1.121.1 / 1.122.0 (GHSA-v98v-ff95-f3cp). Upgrading to 2.31.5 or 2.32.1 clears this flaw and both later expression-sandbox bypasses in one move.
Exploitationyes — CISA-confirmed active exploitation, knownRansomwareCampaignUse: Known; Rapid7 observed in-the-wild exploitation from 2026-05-17; Arctic Wolf documented multiple June 2026 Qilin intrusions
KEV added2026-05-29
CISA deadline2026-06-01
Patched inFixed by Palo Alto Networks 2026-05-13 — see vendor advisory; mitigation note: exploitation requires authentication override cookies enabled with specific certificate configurations
REST API batch endpoint route confusion (CWE-436) chained with WP_Query author__not_in SQL injection (CWE-89) → unauthenticated RCE
Exploitationyes — CISA confirmed active exploitation in the wild for both CVEs (added to KEV 2026-07-21); knownRansomwareCampaignUse: Unknown for both
KEV added2026-07-21
CISA deadline2026-07-24
Patched inFixed in WordPress 6.8.6, 6.9.5, and 7.0.2 — affected: 6.8.x <6.8.6, 6.9.x <6.9.5, 7.0.x <7.0.2. Core upgrade is necessary but not sufficient: audit plugins/themes passing untrusted input into the WP_Query author__not_in parameter
These CVEs are in software an intruder brings with them — typically vulnerable signed drivers abused for kernel-mode actions (BYOVD). You are almost certainly not running them, so there is nothing here to patch. The control is to block the named build from loading and alert on the attempt. They are listed separately for exactly this reason and are not counted in the patch queue above.
BYOVD (bring your own vulnerable driver) with a three-driver interchangeable framework → kernel-mode process termination and EDR impairment; DLL sideloading through signed binaries; NTDLL unhooking; registry-resident shellcode; thread-context-hijack injection into svchost.exe; dual-watchdog persistence. Track 'apt' is a taxonomy container — Cato's SilverFox attribution is moderate-to-high confidence, not established.
Exploitationyes — an observed intrusion at a Japanese industrial manufacturing organization, documented with samples and infrastructure by Cato CTRL. Victim scope beyond that one organization is explicitly not established by the report.
BlocklistNo patch applies to the victim side — this is malicious tooling, not a product flaw. Controls: enable Microsoft's vulnerable driver blocklist / HVCI and add BootRepair.sys, EnPortv.sys, wsftprm.sys by hash; alert on driver loads from user-writable paths; treat ConvertToPDF.exe / PDFDirect.exe loading a non-vendor PDFCORE8.dll from its own directory as a sideload signal.