SharePoint remote code execution was the month’s clearest emergency: an unauthenticated network attacker could run code on a collaboration server, and CVE-2026-58644 reached CISA’s Known Exploited Vulnerabilities catalog on the day it was published, July 14. July was distinctive not simply for the number of severe bugs, but for where attackers found them: the systems that administer networks, virtual estates and remote access.
SharePoint unsafe deserialization
Microsoft SharePoint Server is the document and collaboration platform that often ends up deeply embedded in enterprise identity, file-sharing and workflow systems. CVE-2026-58644 is unsafe deserialization: SharePoint processes untrusted data as an object it should not trust, allowing an unauthorized attacker to execute code over the network. No account or user action is required in the supplied assessment.
That makes a SharePoint compromise much more than a single web-server incident. It can give an intruder a durable position near sensitive documents and internal business processes. The flaw is actively exploited and KEV-listed. Microsoft addressed it alongside other SharePoint issues, including CVE-2026-50522 and CVE-2026-56164; teams should treat the relevant SharePoint security release as a batch, not narrowly patch only the headline bug.
WordPress route confusion chain
WordPress powers everything from small publishing sites to large public-facing properties, which gives a core bug an unusually broad potential footprint. In affected 6.9.x releases before 6.9.5 and 7.0.x releases before 7.0.2, CVE-2026-63030 confuses routes in the REST API batch endpoint. On its own, that is bad routing logic; combined with the author__not_in SQL injection in CVE-2026-60137, it can lead to SQL injection and remote code execution.
The chain is being exploited and is KEV-listed. WordPress 6.9.5 and 7.0.2 contain the stated fixes, so this is a straightforward case for getting core current rather than waiting for a maintenance window. It also matters beyond the named releases: July’s wider pool included exploited plugin and theme bugs involving file upload, object injection and account takeover. A current core installation with a forgotten extension is not much comfort.
SonicWall and Check Point bypasses
The nastiest concentration of July’s exploited flaws was in the control planes defenders expose to make everything else work. CVE-2026-15409 is a server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface. A remote, unauthenticated attacker can induce the appliance to request unintended locations. It is KEV-listed and tied to known ransomware activity—an especially important distinction for an appliance commonly positioned at the network edge. SonicWall’s advisory is available; the supplied material does not identify the fixed firmware version, so administrators should use that advisory to establish the applicable update.
Check Point’s CVE-2026-16232 is even more direct: an authentication bypass in SmartConsole can yield a login token with full administrative privileges. An attacker needs internet access to the Management Server and a deployment that does not restrict Trusted Clients. Check Point says exploitation has affected a very small number of customers, but it is active and KEV-listed. Full administration of the security-management console means the ability to alter policies and configurations—the controls meant to stop an intrusion in the first place.
Arista VeloCloud Orchestrator on-prem belongs in the same urgent queue. CVE-2026-16812, an actively exploited and KEV-listed OS command injection, lets a remote attacker reach privileged internal functionality and affect the orchestrator host. Hosted and Dedicated VCO were patched before disclosure; on-prem operators need the vendor’s remediation. These are different products and bug classes, but they share the operational consequence: one exposed management endpoint can become a lever over a much larger environment.
Firefox accessibility sandbox escape
Not every consequential July issue lived at the perimeter. CVE-2026-16367 is a sandbox escape caused by an invalid pointer in Firefox and Thunderbird’s Disability Access APIs component. A malicious page or message can exploit the memory-safety failure to break beyond the browser or mail client sandbox, weakening the isolation users rely on when opening untrusted content.
There is no exploitation flag in the supplied material, but the impact is worth taking seriously because sandbox escapes are valuable parts of real browser attack chains. Mozilla fixed it in Firefox 153 and Thunderbird 153. Desktop teams should make those versions the baseline rather than viewing this as an optional application update.
Management planes became the prize
July’s exploited cases point to a simple prioritization rule: start with internet-facing administrative systems, not just ordinary application servers. SonicWall remote-access appliances, Check Point management servers and VeloCloud orchestration each concentrate authority over users, traffic or infrastructure. The same pattern appears in the month’s other high-ranked disclosures: CVE-2026-59309 can bypass authentication in VMware vCenter’s Directory Service for attackers with network access, while CVE-2026-40139 can bypass access controls in BeyondTrust Remote Support and Privileged Remote Access when a specific authentication configuration is enabled. The BeyondTrust release also included CVE-2026-40141.
Neither of those latter two was identified as exploited in the provided material, but both target systems whose purpose is privileged administration. That is why the distinction between “internet-facing” and “internal” deserves scrutiny: an internal management plane may still be reachable from a compromised endpoint, partner network or VPN session. The wider July pool reinforces the point from another direction. AI and MCP services are introducing new administrative-style APIs and agents, often with immature exposure controls, while a broad Linux kernel repair wave touched networking, filesystems, SMB, RDMA and storage. There was plenty to patch; the access paths with the most authority deserved to go first.
July added up to an uncomfortable lesson in concentration of risk: attackers did not need exotic initial access when exposed collaboration servers and control planes offered it. Patch the actively exploited SharePoint, WordPress and edge-management issues first, and verify which management interfaces are truly reachable; SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, so teams can focus on the releases that apply to them rather than sift the entire month’s list.
