Comparing 22 July 2026 with the previous day 21 July 2026.
The vulnerability enables remote code execution through unsafe deserialization and is already listed on the CISA KEV catalog, indicating active exploitation; BOD 26-04 compliance is mandated.
The patch release includes 56 critical vulnerabilities in Windows Server and Office products, including remote code execution flaws in Dynamics NAV and a BitLocker bypass with public exploit.
This is a monthly patch summary with no indication of active exploitation or geopolitical significance; purely routine vulnerability management information.
CVE-2026-50522 is being actively exploited in attack campaigns to steal machine keys and establish persistent access; this is the fourth SharePoint vulnerability exploited in this month.
The vulnerability allows malicious websites to access WhatsApp Web data through inadequate access controls in the Adobe Acrobat browser extension,an attack that can occur silently and affects hundreds of millions of users.
A vulnerability already patched by Oracle is catalogued here as a new CVE with a future date (2026), with no evidence of active exploitation or novel attack patterns.
First joint UK-EU sanctions against Russian cyber and disinformation actors underscore escalation of state-APT activity in Europe and growing geopolitical dimension of cyber threats to DACH regions.
Russian state-sponsored actors are conducting targeted attacks against routers to gain access to critical infrastructure and industrial networks , a direct threat to European manufacturing facilities operating network perimeter devices.
Kaspersky research shows that attackers continue to exploit years-old vulnerabilities such as EternalBlue (MS17-010 from 2017) to compromise networks, underscoring that patch-management gaps remain a strategic risk for enterprise infrastructure.
Iranian threat actors are conducting escalating attacks against operational technology systems, particularly targeting HMI and SCADA displays in manufacturing facilities,a direct scenario for European manufacturers in geopolitically sensitive sectors.
The vulnerability enables unauthenticated network-based DoS attacks but impacts only availability (no data compromise) and is a standard Oracle patching cycle release.
A locally triggered privilege escalation in snap-confine allows unprivileged local users to obtain root access on default desktop installations.
Rapid7 disclosed a chained exploit combining authentication bypass (CVE-2026-55040) with a separate RCE vulnerability; unauthenticated attackers can achieve remote code execution on SharePoint servers , patching the authentication bypass breaks the exploit chain.
OpenSSH vulnerabilities enable local code execution and pose immediate risks to Ubuntu systems used for remote administration.
Multiple critical vulnerabilities in Firefox, Firefox ESR, and Thunderbird enable arbitrary code execution and sandbox escape; BSI advisory without specific CVE numbers indicates bundled security updates.
AI-aided vulnerability discovery drives record patch numbers; meanwhile, tests show that automated exploit generation is rendering Microsoft's exploitability rating obsolete.
48 of the 57 critical vulnerabilities are RCE flaws, two of which are already being exploited in the wild; Snort detection rules are available.
BSI advisory confirms critical and zero-day vulnerabilities in SharePoint without further technical details; patch status and affected versions should be immediately verified via Microsoft channels.
The vulnerability enables unauthorized VPN access without authentication and is already being actively exploited in the field , an immediate risk for manufacturing networks and critical infrastructure.
The BSI warning covers multiple critical UniFi vulnerabilities without specifying CVE numbers or proof-of-concept status , organizations should immediately monitor Ubiquiti security advisories for affected versions and patches.
ARToken reveals a sophisticated PhaaS infrastructure with 80+ API endpoints for PRT persistence, device code phishing, and SharePoint exfiltration , an actively exploited ecosystem for large-scale compromise of Microsoft 365 environments.
The vulnerability enables a sandbox escape following prior compromise of the renderer process, requiring chaining with browser RCE exploits for complete system takeover.
After renderer process compromise, attackers can exploit crafted HTML to exfiltrate cross-origin data, undermining browser content isolation.
A heap buffer overflow in the V8 engine enables remote code execution within the Chrome sandbox; patching to version 150.0.7871.182 or later is required.
This is an isolated and timely security vulnerability with no signs of active exploitation in the wild, but requires immediate updating to Chrome 150.0.7871.182 or later.
Local privilege escalation in Veeam Updater allows unauthenticated local users root-level access to the appliance operating system , critical for backup infrastructure with direct access.
The campaign leverages 7,600 legitimate GitHub repositories as a distribution channel for infostealers and downloader malware, affecting both developers and end-users while undermining trust in open-source platforms.
BSI warns of multiple Edge vulnerabilities enabling code execution and privilege escalation, requiring user interaction for exploitation.
BSI warns of multiple Chrome vulnerabilities without detailed CVE disclosure; details are not yet public, but patching should be prioritized as code execution is possible.
BSI alerts to multiple vulnerabilities in UniFi OS Server without specific CVE identifiers; concrete patch status and update availability are currently undocumented.
A local code execution vulnerability in Adobe Acrobat Reader enables full system compromise and requires immediate patching.
The vulnerability allows local attackers to gain root access to the system via the Veeam Updater component; a patch (version 12.3.0.65) is already available.
The Kratos phishing platform (also known as SneakyLog) was dismantled by German and US authorities after running approximately 15,000 phishing campaigns monthly and stealing session cookies to bypass 2FA.
BSI warning on Python RCE vulnerability enabling arbitrary code execution; relevant to all systems executing Python.
BSI has documented multiple critical vulnerabilities in Aruba AOS-CX switches that allow security bypass and arbitrary code execution , relevant to network segmentation and access control in production environments.
A local privilege escalation vulnerability in Veeam Backup & Replication requires immediate attention as it can be exploited by attackers with local system access to compromise the system.
BSI advisory on multiple Firefox vulnerabilities without specific CVE numbers; practical patches should be sourced from Mozilla release notes or security updates.
BSI advisory on multiple Chrome vulnerabilities without specific CVE numbers; exploitation may require user interaction (e.g., visiting a malicious website).
CISA warns of active exploitation of SharePoint vulnerabilities and urges hardening measures, indicating ongoing attacks in the wild.
A remote code execution vulnerability in 7-Zip affecting NTFS archive processing requires user interaction for exploitation and poses immediate risk to all installations.
The vulnerabilities remain undisclosed at publication time, indicating an active coordinated disclosure process; technical details and exploitability status remain unclear.
North Korean Kimsuky APT distributes ScreenConnect as counterfeit freeware installers (OBS Studio, DS4Windows, Glary Utilities) to gain enterprise network access; linked to AppleSeed malware and new PebbleDash-based tools.
After October, Exchange 2016 and 2019 will no longer receive security updates , organisations running these versions must evaluate migration or Extended Security Update (ESU) licensing to maintain compliance and security.
A locally exploitable privilege escalation in snapd enables unauthorized root access on Ubuntu systems without authentication.
A previously unlisted heap-overflow vulnerability in the WinRAR RAR5 parser enables remote code execution through specially crafted archives and requires user interaction.
Without specific CVE numbers, affected product versions, or indications of active exploitation, this is a generic patch announcement with no strategic added value.
Microsoft is making passkeys the default authentication method in Entra ID starting September 2026 to increase phishing resistance and reduce reliance on SMS and voice-based factors.
BSI warning on multiple Linux kernel vulnerabilities with local exploitability; specific CVE numbers not mentioned, so context unclear.
An authenticated vulnerability in Synology DSM enables information disclosure; BSI warning indicates a remediated or documented risk.
The BSI advisory warns of multiple Firefox vulnerabilities without specific CVE numbers or exploit details, suggesting a generic security notice, possibly as part of regular updates or patch roundup.
BSI warns of multiple Linux kernel vulnerabilities without specific CVE identifiers or exploitation status,detailed technical analysis is required to assess impact and urgency.
No changes in this category.
No changes in this category.
Qilin actors are deliberately exploiting an authentication bypass vulnerability as an entry point into production environments,an indicator of ransomware campaigns targeting the industrial sector.
The alert describes active in-the-wild exploitation (webshell installation, persistent infection) rather than patch availability alone,critical for security of internet-facing WordPress instances.
CVE-2026-50522 is already under active exploitation and is the third SharePoint vulnerability in July 2026 to come under attack immediately after disclosure; prior variants were weaponized as zero-days before patching.
A local privilege escalation flaw in Windows WMI allows local attackers to escalate from low-privilege to SYSTEM-level access; affects Windows Server 2022/2019 and all AD-joined clients in hybrid DACH infrastructure.
A local privilege escalation vulnerability in Windows WMI requires already-compromised low-privilege accounts for exploitation, but poses significant risk in multi-user production environments.
The vulnerability is actively exploited to steal machine keys, indicating targeted, ongoing attacks in the wild.
Russian intelligence-linked APTs are actively exploiting misconfigured routers as entry points into European critical-infrastructure organisations; this is an active, ongoing campaign pattern with direct relevance to EU/DACH regions.
MFA bypass in ADSelfService Plus allows attackers to compromise AD-integrated authentication and gain unauthorized access to enterprise-wide resources.
SANDWORM exploits AI coding assistants and LLM toolchains as novel supply-chain attack vectors by fingerprinting runtime behavior of developer workstations and CI automation,a qualitatively new threat class for organizations conducting internal software development.
North Korean IT worker networks directly finance Russia's war effort through sanctions evasion; this demonstrates an operationalized alliance between North Korea and Russia that elevates DACH organizations as potential targets for retaliation or espionage.
The vulnerability enables remote code execution via specially crafted HTML pages without prior authentication, requiring immediate patch prioritization for all Chrome installations in production environments.
Pwn2Own-demonstrated vulnerability in Microsoft Edge enables code execution via malicious web pages or files; exploitation requires user interaction.
The Qilin ransomware group is actively exploiting a critical authentication bypass flaw in Palo Alto PAN-OS GlobalProtect to infiltrate networks, indicating an ongoing campaign against enterprise environments.
BSI warns of multiple critical-severity vulnerabilities in GNU libc; these are widespread on Linux systems and require timely patching.
The vulnerability enables remote code execution within the Chrome sandbox via crafted HTML pages, but is a standard patch update with no evidence of active exploitation in the wild.
The vulnerability allows local attackers to exploit heap corruption via malicious files; it requires local access and is therefore primarily relevant in scenarios involving untrusted file handling or USB access.
Kratos platform automated approximately 15,000 phishing campaigns per month; BKA dismantling reveals operational vulnerability of centralized phishing-as-a-service infrastructure in German jurisdiction.
BSI warning for multiple unspecified vulnerabilities in Chrome and Edge , patch details are missing; follow-up advisories with CVE numbers and CVSS scores are to be expected.
HollowGraph abuses Microsoft's legitimate Calendar service as a bidirectional command-and-control channel, bypassing traditional email and network-based detection and blurring the line between legitimate cloud operations and malware communication.
The BSI/BürgerCERT advisory discloses multiple vulnerabilities in widely-used browsers without technical details, likely coordinating with vendors ahead of public disclosure.
The BSI warning covers multiple unspecified vulnerabilities in Firefox/Thunderbird without CVE details or active exploitation confirmation; unclear whether public exploits exist or if this is an aggregated patch summary.
wp2shell vulnerabilities in WordPress Core enable unauthenticated remote code execution; exploitation activity began within hours of patch release, and compromised sites are used as delivery mechanisms for credential theft, malware, and fraud.
Unknown threat actors are actively exploiting multiple SonicWall SMA1000 zero-days to deploy custom malware on VPN appliances , a direct attack vector against remote access infrastructure.
An unofficial patch for a Windows zero-day with admin privilege escalation is circulating publicly while an official Microsoft fix remains pending.
OilRig APT exploits Outlook calendar events as a steganographic C2 channel and leverages DNS AAAA records for configuration recovery,a novel abuse pattern of Microsoft-hosted services.
Vendor-signed UEFI drivers from multiple manufacturers enable pre-boot code execution via BYOVD attacks, requiring DBX updates for revocation.
A leading remote access provider was ordered by German financial regulator to pay damages , a signal for increased liability of security failures in critical B2B tools.
The alert describes a known operational issue with WSUS synchronization without new security or exploit implications, but only administrative measures to resolve delays.
BSI warning on generic Linux kernel DoS vulnerabilities without specific CVE references or exploit status , requires contextualisation and link to specific patches.