July 2026 CVE Landscape

Malware Analysis
1

In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation, 36 of which had a Very Critical Recorded Future Risk Score. This represents a 44% increase from last month. 26 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 55 were reported by vendors, and four were primarily surfaced through honeypot data.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

    <p>The 85 vulnerabilities in this report affected products from 61 vendors, with Microsoft accounting for approximately 12% of the vulnerabilities. The remaining exposure was concentrated across a range of enterprise software, security products, network infrastructure, developer tooling, and cloud platform vendors.</p>
    <p>Insikt Group previously created a Nuclei template to detect the Langflow vulnerability (CVE-2025-3248) featured in this report. These are available to Recorded Future customers via the Recorded Future Intelligence Platform.</p>
    <h2>Quick reference: July 2026 Vulnerability Table</h2>
    <p><em>All 81 vulnerabilities below were actively exploited or operationally weaponized in July 2026. This table does not include the four CVEs that were primarily surfaced through our honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report. The table below also provides examples of public PoCs identified by Insikt Group. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.</em></p>
    <div>
      <div>
        <div><strong>#</strong></div>
        <div><strong>Vulnerability</strong></div>
        <div><strong>Risk</strong><br /><strong>Score</strong></div>
        <div><strong>Vendor/Product</strong></div>
        <div><strong>KEV</strong></div>
        <div><strong>Analysis</strong></div>
        <div><strong>RCE</strong></div>
        <div><strong>PoC</strong></div>
      </div>
      <div>
        <div>1</div>
        <div>CVE-2008-4128</div>
        <div>99</div>
        <div>Cisco IOS</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://www.exploit-db.com/exploits/6477" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>2</div>
        <div>CVE-2017-17215</div>
        <div>99</div>
        <div>Huawei HG532</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2017-17215&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>3</div>
        <div>CVE-2018-0802</div>
        <div>99</div>
        <div>Microsoft Office Equation Editor</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2018-0802&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>4</div>
        <div>CVE-2021-4034</div>
        <div>99</div>
        <div>Polkit</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2021-4034&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>5</div>
        <div>CVE-2021-27137</div>
        <div>99</div>
        <div>DD-WRT</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>6</div>
        <div>CVE-2023-4346</div>
        <div>99</div>
        <div>KNX Association KNX Protocol Connection Authorization Option 1</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>7</div>
        <div>CVE-2025-55182</div>
        <div>99</div>
        <div>Meta React Server Components</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-55182&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>8</div>
        <div>CVE-2025-68686</div>
        <div>99</div>
        <div>Fortinet FortiOS</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>9</div>
        <div>CVE-2026-0770</div>
        <div>99</div>
        <div>Langflow</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-0770&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>10</div>
        <div>CVE-2026-15409</div>
        <div>99</div>
        <div>SonicWall SMA1000 Appliances</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-15409&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>11</div>
        <div>CVE-2026-15410</div>
        <div>99</div>
        <div>SonicWall SMA1000 Appliances</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-15410&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>12</div>
        <div>CVE-2026-16232</div>
        <div>99</div>
        <div>Check Point SmartConsole</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-16232&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>13</div>
        <div>CVE-2026-16812</div>
        <div>99</div>
        <div>Arista VeloCloud Orchestrator</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>14</div>
        <div>CVE-2026-20316</div>
        <div>99</div>
        <div>Cisco Secure Firewall Management Center (FMC)</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>15</div>
        <div>CVE-2026-25089</div>
        <div>99</div>
        <div>Fortinet FortiSandbox</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-25089&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>16</div>
        <div>CVE-2026-34486</div>
        <div>99</div>
        <div>Apache Tomcat</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>17</div>
        <div>CVE-2026-39808</div>
        <div>99</div>
        <div>Fortinet FortiSandbox</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-39808&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>18</div>
        <div>CVE-2026-39987</div>
        <div>99</div>
        <div>Marimo</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>19</div>
        <div>CVE-2026-46817</div>
        <div>99</div>
        <div>Oracle E-Business Suite</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-46817&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>20</div>
        <div>CVE-2026-48282</div>
        <div>99</div>
        <div>Adobe ColdFusion</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-48282&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>21</div>
        <div>CVE-2026-48907</div>
        <div>99</div>
        <div>JoomlaContentEditor.net Joomla Content Editor (JCE)</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-48907&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>22</div>
        <div>CVE-2026-48908</div>
        <div>99</div>
        <div>JoomShaper SP Page Builder</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-48908&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>23</div>
        <div>CVE-2026-48939</div>
        <div>99</div>
        <div>iCagenda</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-48939&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>24</div>
        <div>CVE-2026-50522</div>
        <div>99</div>
        <div>Microsoft SharePoint</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-50522&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>25</div>
        <div>CVE-2026-55255</div>
        <div>99</div>
        <div>Langflow</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/rootdirective-sec/CVE-2026-55255-Lab" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>26</div>
        <div>CVE-2026-56155</div>
        <div>99</div>
        <div>Microsoft Active Directory Federation Services</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>27</div>
        <div>CVE-2026-56164</div>
        <div>99</div>
        <div>Microsoft SharePoint Server</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/sentinel-aidefense/CVE-2026-56164-EXP" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>28</div>
        <div>CVE-2026-56290</div>
        <div>99</div>
        <div>Joomlack Page Builder</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-56290&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>29</div>
        <div>CVE-2026-56291</div>
        <div>99</div>
        <div>Balbooa Forms</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-56291&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>30</div>
        <div>CVE-2026-58644</div>
        <div>99</div>
        <div>Microsoft SharePoint</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>31</div>
        <div>CVE-2026-60137</div>
        <div>99</div>
        <div>WordPress Core</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-60137&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>32</div>
        <div>CVE-2026-63030</div>
        <div>99</div>
        <div>WordPress Core</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-63030&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>33</div>
        <div>CVE-2021-3156</div>
        <div>89</div>
        <div>Sudo</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2021-3156&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>34</div>
        <div>CVE-2021-29441</div>
        <div>89</div>
        <div>Alibaba Nacos</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2021-29441&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>35</div>
        <div>CVE-2025-6389</div>
        <div>89</div>
        <div>Sneeit Framework</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-6389&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>36</div>
        <div>CVE-2025-9491</div>
        <div>89</div>
        <div>Microsoft Windows</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/Amperclock/CVE-2025-9491_POC" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>37</div>
        <div>CVE-2025-32432</div>
        <div>89</div>
        <div>Craft CMS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-32432&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>38</div>
        <div>CVE-2025-3248</div>
        <div>89</div>
        <div>Langflow</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-3248&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>39</div>
        <div>CVE-2025-34152</div>
        <div>89</div>
        <div>Shenzhen Aitemi M300 Wi-Fi Repeater</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/kh4sh3i/CVE-2025-34152" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>40</div>
        <div>CVE-2025-49113</div>
        <div>89</div>
        <div>Roundcube Webmail</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-49113&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>41</div>
        <div>CVE-2025-66376</div>
        <div>89</div>
        <div>Zimbra Collaboration</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>42</div>
        <div>CVE-2026-0257</div>
        <div>89</div>
        <div>Palo Alto Networks PAN-OS and Prisma Access</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-0257&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>43</div>
        <div>CVE-2026-0740</div>
        <div>89</div>
        <div>SaturdayDrive Ninja Forms - File Uploads</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-0740&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>44</div>
        <div>CVE-2026-3055</div>
        <div>89</div>
        <div>NetScaler ADC and Gateway</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>45</div>
        <div>CVE-2026-6875</div>
        <div>89</div>
        <div>ServiceNow AI Platform</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-6875&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>46</div>
        <div>CVE-2026-12569</div>
        <div>89</div>
        <div>PTC Windchill PDMLink and FlexPLM</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>47</div>
        <div>CVE-2026-29014</div>
        <div>89</div>
        <div>MetInfo CMS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://karmainsecurity.com/KIS-2026-06" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>48</div>
        <div>CVE-2026-42897</div>
        <div>89</div>
        <div>Microsoft Exchange Server 2016 CU23 and Subscription Edition RTM</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/atiilla/CVE-2026-42897" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>49</div>
        <div>CVE-2026-45659</div>
        <div>89</div>
        <div>Microsoft SharePoint Server</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>50</div>
        <div>CVE-2026-31843</div>
        <div>87</div>
        <div>goodoneuz pay-uz</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>51</div>
        <div>CVE-2013-3307</div>
        <div>79</div>
        <div>Linksys E1000, E1200, and E3200</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>52</div>
        <div>CVE-2016-20016</div>
        <div>79</div>
        <div>MVPower TV-7104HE and TV-7108HE DVRs</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://www.exploit-db.com/exploits/41471" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>53</div>
        <div>CVE-2017-5259</div>
        <div>79</div>
        <div>Cambium Networks cnPilot</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>54</div>
        <div>CVE-2017-7269</div>
        <div>79</div>
        <div>Microsoft IIS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2017-7269&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>55</div>
        <div>CVE-2018-11511</div>
        <div>79</div>
        <div>ASUSTOR ADM Photo Gallery</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://www.exploit-db.com/exploits/45200/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>56</div>
        <div>CVE-2018-14558</div>
        <div>79</div>
        <div>Tenda AC9, AC10, and AC7 firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>57</div>
        <div>CVE-2020-8515</div>
        <div>79</div>
        <div>DrayTek Vigor2960, Vigor300B, and Vigor3900 firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2020-8515&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>58</div>
        <div>CVE-2020-22653</div>
        <div>79</div>
        <div>Ruckus APs, SmartZone, and ZoneDirector</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>59</div>
        <div>CVE-2020-22658</div>
        <div>79</div>
        <div>Ruckus APs, SmartZone, and ZoneDirector</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>60</div>
        <div>CVE-2020-25499</div>
        <div>79</div>
        <div>TOTOLINK A3002RU firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/kdoos/Vulnerabilities/blob/main/RCE_TOTOLINK-A3002RU-V2" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>61</div>
        <div>CVE-2020-36847</div>
        <div>79</div>
        <div>Eemitch Simple File List</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://packetstormsecurity.com/files/160221/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>62</div>
        <div>CVE-2021-31755</div>
        <div>79</div>
        <div>Tenda AC11 firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>63</div>
        <div>CVE-2021-32305</div>
        <div>79</div>
        <div>WebSVN</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2021-32305&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>64</div>
        <div>CVE-2022-35733</div>
        <div>79</div>
        <div>UNIMO Technology UDR-JA1004, UDR-JA1008, and UDR-JA1016 digital video recorders</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>65</div>
        <div>CVE-2023-25717</div>
        <div>79</div>
        <div>Ruckus Wireless Admin</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>66</div>
        <div>CVE-2024-42009</div>
        <div>79</div>
        <div>RoundCube Webmail</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2024-42009&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>67</div>
        <div>CVE-2025-9528</div>
        <div>79</div>
        <div>Linksys E1700</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_61/61.md#poc" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>68</div>
        <div>CVE-2025-12057</div>
        <div>79</div>
        <div>WavePlayer</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/DeadExpl0it/CVE-2025-12057-WordPress-Exploit-PoC" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>69</div>
        <div>CVE-2025-12352</div>
        <div>79</div>
        <div>Gravity Forms</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>70</div>
        <div>CVE-2025-13486</div>
        <div>79</div>
        <div>Hwk-Fr Advanced Custom Fields: Extended</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-13486&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>71</div>
        <div>CVE-2025-28137</div>
        <div>79</div>
        <div>TOTOLINK A810R firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28137.md#poc" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>72</div>
        <div>CVE-2026-1357</div>
        <div>79</div>
        <div>WPvivid Backup, Migration &amp; Staging</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-1357&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>73</div>
        <div>CVE-2026-3395</div>
        <div>79</div>
        <div>MaxSite CMS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-3395&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>74</div>
        <div>CVE-2026-3844</div>
        <div>79</div>
        <div>Cloudways Breeze Cache</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-3844&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>75</div>
        <div>CVE-2026-16723</div>
        <div>79</div>
        <div>Alibaba Fastjson</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-16723&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>76</div>
        <div>CVE-2026-29059</div>
        <div>79</div>
        <div>Windmill</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>77</div>
        <div>CVE-2026-33824</div>
        <div>79</div>
        <div>Microsoft Windows IKE Extension</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>78</div>
        <div>CVE-2021-24139</div>
        <div>78</div>
        <div>Photo Gallery by 10Web</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>79</div>
        <div>CVE-2025-7852</div>
        <div>78</div>
        <div>Iqonic Design WPBookit</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>80</div>
        <div>CVE-2026-1969</div>
        <div>72</div>
        <div>ThemeREX Addons WordPress plugin</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>81</div>
        <div>CVE-2025-7443</div>
        <div>71</div>
        <div>BerqWP Automated Page Speed Optimization</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
    </div>
    <p><em><strong>Table 1:</strong></em> <em>List of vulnerabilities that were actively exploited in July, 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).</em></p>
    <h2>Key trends: July 2026</h2>
    <ul>
      <li>In July 2026, the Dysphoria botnet was used to exploit known IoT and embedded-device flaws to build DDoS and relay infrastructure; Cloud Atlas abused Microsoft Equation Editor to deliver CloudAtlasGo; Armored Likho used a malicious Windows shortcut to deploy BusySnake Stealer; and JADEPUFFER and Cl0p targeted exposed AI and product-lifecycle platforms for encryption, data theft, and extortion.</li>
      <li>57 of the 85 vulnerabilities enabled remote code execution (RCE), including flaws affecting Microsoft, Fortinet, Langflow, ServiceNow, WordPress, and Joomla ecosystems, internet-facing security appliances, and embedded network devices.</li>
      <li>We identified public proof-of-concept (PoC) exploits and scanners for 60 of the 85 vulnerabilities in this report.</li>
      <li>The most commonly observed weakness classes were CWE-78 (OS Command Injection), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-94 (Code Injection), and CWE-502 (Deserialization of Untrusted Data).</li>
      <li>14 of the 85 vulnerabilities in this month’s table are at least 5 years old, with the oldest approximately 18 years old, reinforcing how threat actors continue to exploit long-known weaknesses in environments where patching has lagged. Additionally, the fastest observed time from a vulnerability’s public disclosure to reported exploitation was less than one day.</li>
    </ul>
    <h2>Trend analysis: Malware-Linked Exploitation Spans IoT, Email, and Enterprise Applications</h2>
    <p>An Insikt Group® TTP Instance on the Dysphoria botnet linked CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, CVE-2025-9528 to the exploitation of routers, gateways, cameras, repeaters, and other embedded Linux devices. Dysphoria combined known RCE flaws with weak Telnet and Secure Shell credentials to enroll compromised systems into DDoS and relay infrastructure.</p>
    <div>
      <div>
        <div>
          <img alt="" height="980" src="https://www.recordedfuture.com/media_12709d3da9102be069cc23c7787a6e56d2d1f14ef.png?width=750&amp;format=png&amp;optimize=medium" width="2048" />
        </div>
      </div>
      <div>
        <div><em><strong>Figure 1:</strong></em> <em><a href="https://www.recordedfuture.com/use-case/vulnerability-prioritization" rel="noreferrer" target="_blank">Vulnerability Intelligence Card®</a></em> <em>for CVE-2017-17215 in Recorded Future (Source: Recorded Future)</em></div>
      </div>
    </div>

Article Link: July 2026 CVE Landscape