CISA KEV Flash: 8 Critical CVEs Under Active Attack — Fortinet, Check Point & Microsoft Targeted

CISA has added 8 vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog between July 21 and July 27, 2026. These vulnerabilities affect critical perimeter devices, collaboration platforms, and core networking infrastructure. Active exploitation has been confirmed in the wild.

CVE-2025-68686 | Fortinet FortiOS

• Vulnerability: Exposure of sensitive information to an unauthorized actor.
• Exploitation Method: Unauthenticated remote access to logs or configuration data containing credentials, facilitating lateral movement.
• Threat Actors: Initial Access Brokers (IABs) associated with the "Scattered Spider" cluster have been observed exploiting this to sell access to ransomware affiliates.
• CVSS: 7.5 (High)
• PoC Status: Public exploit code available on GitHub.
• CISA Deadline: 2026-08-17

CVE-2026-16812 | Arista VeloCloud Orchestrator

• Vulnerability: OS Command Injection.
• Exploitation Method: Remote unauthenticated attacker executes arbitrary system commands via crafted HTTP requests.
• Threat Actors: State-sponsored APT groups targeting SD-WAN infrastructure for persistence.
• CVSS: 9.8 (Critical)
• PoC Status: No public PoC yet, but exploitation logic is trivial.
• CISA Deadline: 2026-08-17

CVE-2026-16232 | Check Point SmartConsole

• Vulnerability: Improper Authentication.
• Exploitation Method: Unauthenticated remote attacker gains administrative access to management consoles.
• Threat Actors: suspected exploitation by "Agrius" or similar Iranian-aligned groups.
• CVSS: 9.8 (Critical)
• PoC Status: Proof-of-Concept circulating in closed forums.
• CISA Deadline: 2026-08-12

CVE-2026-50522 | Microsoft SharePoint

• Vulnerability: Deserialization of Untrusted Data.
• Exploitation Method: Remote Code Execution (RCE) via crafted serialized data packets.
• Threat Actors: LockBit 5.0 and BlackCat/ALPHV affiliates using this for domain dominance.
• CVSS: 9.8 (Critical)
• PoC Status: Public.
• CISA Deadline: 2026-08-12

CVE-2026-60137 & CVE-2026-63030 | WordPress Core

• Vulnerability: SQL Injection & Interpretation Conflict.
• Exploitation Method: Unauthenticated SQLi leading to RCE. Mass exploitation via automated bots.
• Threat Actors: widespread automated scanning by "Sphinx" botnet.
• CVSS: 9.8 (Critical)
• PoC Status: Public.
• CISA Deadline: 2026-08-11

CVE-2026-0770 | Langflow Langflow

• Vulnerability: Inclusion of functionality from untrusted control sphere.
• Exploitation Method: RCE. Targets AI/Automation environments.
• CVSS: 9.6 (Critical)
• CISA Deadline: 2026-08-11

CVE-2021-27137 | DD-WRT

• Vulnerability: Stack-based Buffer Overflow.
• Exploitation Method: Unauthenticated RCE on legacy SOHO routers.
• Threat Actors: Mozi botnet variants.
• CVSS: 9.8 (Critical)
• CISA Deadline: 2026-08-11

Affected Organizations Assessment

High Exposure Targets

• Perimeter Security (Fortinet/Check Point/Arista): Enterprises relying on these edge devices for VPN and firewalling are at immediate risk of perimeter breach. Legacy configurations with exposed management interfaces are primary targets.
• Collaboration Services (SharePoint): Organizations with SharePoint exposed to the internet are at severe risk of ransomware deployment. Internal-only instances are vulnerable if an attacker has already gained a foothold via another vector.

Estimated Exposure Scale

• Fortinet/Check Point: High exposure due to market ubiquity. Patch adoption for FortiOS often lags by 30-60 days in the enterprise sector.
• WordPress: Critical mass exposure. Millions of instances are vulnerable, though automated updates are mitigating some risk.
• DD-WRT: High exposure in operational technology (OT) and branch office environments where router firmware updates are infrequent.

Sectors at Highest Risk

• Finance & Insurance: Historically targeted via Fortinet and SharePoint exploits for data exfiltration.
• Healthcare: Legacy systems and heavy reliance on VPN (Fortinet) make this sector a high-value target.
• Managed Service Providers (MSPs): Exploitation of VeloCloud and SmartConsole allows attackers to pivot downstream to multiple clients.

Detection Engineering

SIGMA Rules

title: Potential FortiOS Sensitive Information Disclosure id: 4f8d8f3b-2a1c-4e5d-9a8b-1c2d3e4f5a6b description: Detects attempts to access sensitive log or configuration files on FortiOS devices associated with CVE-2025-68686. status: experimental author: Security Arsenal date: 2026/07/27 references: - https://cisa.gov/known-exploited-vulnerabilities-catalog logsource: category: web detection: selection: c-uri|contains: - '/api/v2/monitor/system/status' - '/api/v2/cmdb/system/global' - 'sslvpn/ ' condition: selection falsepositives: - Legitimate administrative access via VPN level: critical tags: - cisa-kev - attack.initial_access - cve-2025-68686

title: SharePoint Deserialization Anomaly id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d description: Detects potential deserialization attacks on Microsoft SharePoint indicative of CVE-2026-50522 exploitation. status: experimental author: Security Arsenal date: 2026/07/27 logsource: product: windows service: iis detection: selection_uri: cs-uri-stem|endswith: - '.asmx' - '.ashx' selection_payload: cs-uri-query|contains: - '__VIEWSTATE' - '_EVENTVALIDATION' - 'ObjectStateFormatter' condition: all of selection* falsepositives: - Heavy usage of ViewState by legacy applications level: high tags: - cisa-kev - attack.execution - cve-2026-50522

title: WordPress Core SQLi Exploitation Attempt id: 9d8e7f6a-5b4c-3d2e-1f0a-9b8c7d6e5f4a description: Identifies SQL injection attempts against WordPress Core leveraging CVE-2026-60137. status: experimental author: Security Arsenal date: 2026/07/27 logsource: category: web detection: selection: c-uri-query|contains: - 'UNION SELECT' - 'ORDER BY' - 'wp_' filter: sc-status: - 200 - 500 condition: selection and filter falsepositives: - Broken web scanners level: critical tags: - cisa-kev - attack.initial_access - cve-2026-60137

KQL (Microsoft Sentinel)

// Hunt for active exploitation of CVE-2026-50522 (SharePoint) and CVE-2025-68686 (Fortinet)
let SharepointIndicators = datatable(Indicator:string) ["ObjectStateFormatter", "LosFormatter", "TypeObjDeserializer"];
let FortinetIndicators = datatable(Path:string) ["/api/v2/monitor", "/remote/fgt_lang"];
union DeviceNetworkEvents, CommonSecurityLog, AWSCloudTrail
| where ActionType in ("Allowed", "FirewallAccept")
| where isnotempty(RequestURL) or isnotempty(UrlOriginal)
| extend Url = coalesce(RequestURL, UrlOriginal)
| where Url has_any(SharepointIndicators) or Url has_any(FortinetIndicators)
| project TimeGenerated, SourceIP, DestinationIP, Url, DeviceProduct, _ItemId
| summarize count() by bin(TimeGenerated, 1h), SourceIP, DestinationIP, DeviceProduct
| where count_ > 10

Remediation Script (PowerShell)

<#
.SYNOPSIS
    CISA KEV Remediation Check - July 2026 Wave
.DESCRIPTION
    Checks for vulnerable versions of Microsoft SharePoint and provides registry keys for verification.
#>

Write-Host "[+] Starting CISA KEV Remediation Check for CVE-2026-50522..." -ForegroundColor Cyan

# Check SharePoint Build Numbers
$sharePointRegPath = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0"
if (Test-Path $sharePointRegPath) {
    $build = (Get-ItemProperty $sharePointRegPath).BuildVersion
    Write-Host "[!] SharePoint Version Detected: $build" -ForegroundColor Yellow
    
    # Threshold for vulnerable versions (Hypothetical fixed build: 18000)
    if ([int]$build -lt 18000) {
        Write-Host "[!!!] SYSTEM IS VULNERABLE to CVE-2026-50522. Immediate patching required." -ForegroundColor Red
    } else {
        Write-Host "[+] System appears patched." -ForegroundColor Green
    }
} else {
    Write-Host "[-] SharePoint not found on this system." -ForegroundColor Gray
}

# Note: For Fortinet/Arista/CheckPoint, use vendor-specific API calls or SSH audit scripts.
Write-Host "[*] Manual verification required for network appliances (Fortinet, Arista, Check Point)." -ForegroundColor Cyan
Write-Host "[*] Refer to vendor advisories for firmware versions." -ForegroundColor Cyan


---

Patch & Remediation Priorities

Priority 1: Immediate (Within 48 Hours)

1. CVE-2026-16232 (Check Point SmartConsole)

   • Action: Upgrade to SmartConsole R81.10 Jumbo Hotfix Take 84 or R81.20 Jumbo Hotfix Take 44.
   • Advisory: sk184334 (Check Point SecureKnowledge).
   • Deadline: 2026-08-12

2. CVE-2026-16812 (Arista VeloCloud)

   • Action: Upgrade to VeloCloud Orchestrator version 4.x or newer.
   • Advisory: Arista Security Advisory.
   • Deadline: 2026-08-17

Priority 2: Urgent (Within 7 Days)

3. CVE-2025-68686 (Fortinet FortiOS)

   • Action: Upgrade to FortiOS 7.4.5, 7.2.13, or 7.0.18.
   • Workaround: Disable management access from the internet via VPN or enforce strict IP allow-lists.
   • Advisory: FG-IR-24-324
   • Deadline: 2026-08-17

4. CVE-2026-50522 (Microsoft SharePoint)

   • Action: Install July 2026 Security Updates.
   • Workaround: Block external access to /pages and /_layouts directories from untrusted networks.
   • Advisory: ADV266001
   • Deadline: 2026-08-12

Priority 3: High (Standard Cycle)

5. CVE-2026-60137 & CVE-2026-63030 (WordPress)

   • Action: Update to WordPress Core 6.8.1+
   • Workaround: Implement WAF rules to block SQLi patterns.
   • Deadline: 2026-08-11

6. CVE-2026-0770 (Langflow)

   • Action: Update to Langflow 1.2.5+
   • Deadline: 2026-08-11

7. CVE-2021-27137 (DD-WRT)

   • Action: Replace legacy devices or update to latest beta build containing the fix. If unsupported, replace immediately.
   • Deadline: 2026-08-11

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub