From Japanese sources
Translated from Japanese
Prepare for Summer Vacation: Patch Tuesday Overlaps with Obon Holiday Week Raises Risks
Vulnerabilities & Exploits
Critical Remote Code Execution Flaw Patched in Veeam ONE Backup Management Product
Vulnerabilities & Exploits
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog Affecting Langflow, Apache Tomcat and N-central
Vulnerabilities & ExploitsN-able Releases Hotfix for Exploited N-central Authentication Bypass Flaw CVE-2026-18577
N-able has published a hotfix addressing a high-severity authentication bypass vulnerability in its N-central IT operations management platform. The flaw, tracked as CVE-2026-18577, allows attackers to bypass authentication through alternative paths or channels and potentially take over user accounts. It affects N-central 2026.1 and earlier versions and stems from an incomplete fix for the earlier CVE-2026-18556 issue. The vulnerability carries a CVSS v4.0 base score of 8.2 and is rated High severity. Exploitation has already been observed in the wild, with Indicators of Compromise including related IP addresses now publicly available. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on August 2, 2026, and urges customers to apply the update while also recommending agent updates where possible.
Adobe Releases Emergency Update for Campaign Classic Fixing Multiple Critical Vulnerabilities
Adobe has issued an urgent security update for Adobe Campaign Classic to address seven critical vulnerabilities, including several with a maximum CVSSv3.1 base score of 10.0. The flaws affect on-premises deployments on Windows and Linux as well as the on-premises components of hybrid setups. Notably, the newly released fixes also impact the previous emergency update from July 29, version 7.4.3 build 9398, requiring users to apply the latest patch immediately. Among the most severe issues are a server-side request forgery vulnerability tracked as CVE-2026-48331, an input handling flaw in the template engine identified as CVE-2026-48323, and an SQL injection vulnerability labeled CVE-2026-48330. Adobe published the corresponding security advisory on August 3, 2026, urging rapid remediation despite the short interval since the prior update.
MongoDB Server Patches 24 Vulnerabilities Including Critical Flaw in mongod Compute Mode
MongoDB has released updates addressing 24 vulnerabilities in MongoDB Server, with one rated critical. The patches cover multiple branches and include fixes for CVE-2026-13072, which carries a CVSSv3.1 base score of 9.2. The critical issue affects standalone mongod instances with compute mode enabled and stems from insufficient validation of external input that can lead to memory corruption. Additional fixes resolve 16 high-severity issues, seven medium, and one low, including CVE-2026-13059 that could allow unauthorized read-write actions by low-privileged authenticated users. Updated versions MongoDB 8.3.7, 8.2.12, 8.0.28, and 7.0.39 are now available. The company published the updates on July 22, 2026, and urges immediate application to maintain system integrity.
Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails
Security NEXT published its list of the ten most-read articles for the week of July 26 to August 1, 2026. The ranking is dominated by high-severity vulnerabilities affecting widely deployed enterprise platforms. VMware released fixes for serious flaws in ESX and vCenter, while Fortinet confirmed active exploitation of vulnerabilities in FortiOS and VeloCloud Orchestrator. Google patched 370 security issues in Chrome, and a data-conversion library fastjson was found vulnerable with observed attacks. Apple shipped iOS 26.6 and iPadOS 26.6 containing fixes for 87 vulnerabilities, and Cisco warned that its Firewall Management Center is already being exploited. Additional patches addressed OpenAM, Node.js, and a critical flaw dubbed KindaRails2Shell in Ruby on Rails. The list also includes a breach at an ANA Group e-commerce site that may have exposed customer data.
pgAdmin 4 Issues Critical Security Update Addressing Seven Vulnerabilities Including Prior Patch Failures
The pgAdmin 4 development team has released version 9.17 to resolve seven vulnerabilities in the popular PostgreSQL database management tool. The update covers two newly discovered issues rated Critical, one Critical flaw stemming from incomplete remediation in the previous 9.16 release, and four additional vulnerabilities. Among the new flaws is CVE-2026-17566, an OS command injection vulnerability in the query-based data export feature caused by insufficient SQL validation. Another Critical issue, CVE-2026-17349, allows duplication of shared servers to inadvertently copy stored database credentials belonging to other users. The incomplete fix for CVE-2026-12045 led to CVE-2026-17351, which bypasses the read-only restrictions of the AI Assistant due to differing string literal interpretations between the SQL parsing library and PostgreSQL.
Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A severe vulnerability tracked as CVE-2026-66066 has been identified in the Ruby on Rails web application framework. The flaw, also referred to as KindaRails2Shell by researchers, impacts applications that use Active Storage with the libvips image processing engine. Attackers can exploit the issue by uploading specially crafted files to read arbitrary files without authentication. This exposure may lead to theft of environment variables, secret keys, and external service credentials, enabling remote code execution or further attacks. The vulnerability stems from unsafe operations in the dependent libvips library. It carries a CVSS v4.0 base score of 9.5 and is rated Critical. JPCERT/CC has issued an advisory urging immediate updates.
Critical Vulnerabilities Disclosed in Adobe Campaign Classic Require Immediate Patching
Adobe has released a security advisory detailing two high-risk vulnerabilities affecting Adobe Campaign Classic on-premises deployments on Windows and Linux. CVE-2026-48449 is an improper authorization flaw that permits remote attackers to execute arbitrary code without authentication and carries a maximum CVSSv3.1 base score of 10.0. CVE-2026-48448 is a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary files from the file system, rated at 8.6. Both issues affect the campaign management platform used by organizations for marketing automation. Adobe urges administrators to apply the available security updates without delay due to the elevated risk of exploitation.
Google Releases Chrome Security Update Fixing 370 Vulnerabilities Including Seven Critical Issues
Google has issued a major security update for Chrome that addresses a total of 370 vulnerabilities across Windows, macOS, and Linux platforms. The update covers Chrome versions 151.0.7922.72 and 151.0.7922.71 and includes seven vulnerabilities rated Critical, the highest severity level. Among the critical flaws are multiple Use After Free issues affecting Compositing, Views, Skia, and Ozone components, plus input validation problems in Dawn and ANGLE graphics libraries and a race condition in the Updater component. In addition to the critical fixes, the release patches 71 High-severity vulnerabilities, 170 Medium-severity issues, and 122 Low-severity issues. The company plans a gradual rollout over the coming days and weeks. All listed CVEs from CVE-2026-17650 through CVE-2026-18019 have been resolved in this update.
Cisco Secure Firewall Management Center Patched for Hardcoded Credential Vulnerability CVE-2026-20316 Already Exploited in the Wild
Cisco Systems has disclosed and patched a hardcoded credential vulnerability in its Cisco Secure Firewall Management Center (FMC) product that allows remote attackers to log in and access sensitive information. The flaw, tracked as CVE-2026-20316, affects the web interface and carries a CVSS v3.1 base score of 5.3, yet Cisco rated it High severity due to the risk of privilege escalation when chained with other vulnerabilities. Zero-day exploitation was observed in July 2026, prompting immediate action from both the vendor and U.S. authorities. CISA added the issue to its Known Exploited Vulnerabilities catalog on the same day and directed federal agencies to apply mitigations by August 1. The advisory highlights that the static credentials enable low-privileged access that could be leveraged for more severe attacks. Cisco released the security advisory on July 29, 2026, and urged customers to update their deployments promptly.
Broadcom Releases Critical Security Updates for VMware vCenter and ESX Vulnerabilities
Broadcom has issued security updates addressing five vulnerabilities in VMware vCenter and VMware ESX, including two rated as Critical. The flaws affect VMware Directory Service and Syslog server processing, potentially allowing authentication bypass and arbitrary code execution. CVE-2026-59309 enables attackers to bypass authentication over the network in VMware Directory Service, risking unauthorized system access. CVE-2026-59310 involves a path traversal issue in Syslog server handling that could lead to remote code execution. Multiple related products including VMware vSphere Foundation, VMware Cloud Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure are also impacted. The advisory VMSA-2026-0006 was published on July 29, 2026, with patches now available.
NVIDIA Patches Critical VIRTIO-Net Flaw in BlueField 3 Allowing VM Code Execution
NVIDIA has released a security update addressing a critical vulnerability in the VIRTIO-Net component used with its BlueField 3 DPU. The flaw, tracked as CVE-2026-65094, enables virtual machine users to execute arbitrary code within the VIRTIO-Net execution context through crafted messages that perform unauthorized memory writes. Originally assigned CVE-2025-33209, the identifier was later withdrawn and replaced. The issue was discovered internally by NVIDIA and carries a CVSS v3.1 base score of 9.0, rated Critical. Affected versions include VIRTIO-Net 25.10.6, 25.10.2, 24.10.50, and 23.10.23, with fixes available in subsequent releases. Organizations are advised to update immediately to mitigate the risk of code execution by untrusted VM tenants.
Adobe Patches Critical Vulnerabilities in Bridge and Format Plugins
Adobe has released security updates addressing multiple critical vulnerabilities in Adobe Bridge and Adobe Format Plugins. The updates, published on July 28, 2026, resolve eight flaws in Adobe Bridge including search path issues tracked as CVE-2026-48395 and CVE-2026-48391, authorization problems under CVE-2026-48396 and CVE-2026-48390, plus path traversal CVE-2026-48374 and out-of-bounds write vulnerabilities CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394. Adobe Format Plugins received a fix for the heap-based buffer overflow CVE-2026-48372 that could allow arbitrary code execution. The company published separate security advisories detailing the affected versions and remediation steps. These patches close attack vectors that could lead to remote code execution or unauthorized access when users open malicious files or rely on untrusted paths.
Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has disclosed a critical vulnerability in its on-premises TeamCity CI/CD server that permits remote attackers to execute arbitrary operating system commands without authentication. The flaw, tracked as CVE-2026-63077, affects the agent polling protocol and can be exploited simply by accessing the TeamCity Server over HTTP or HTTPS. With a CVSSv3.1 base score of 9.8, the issue is rated Critical and could lead to data theft, configuration changes, or compromise of build artifacts and downstream pipelines. No in-the-wild exploitation had been observed at the time of disclosure. JetBrains has released fixed versions TeamCity 2026.1.3 and 2025.11.7, along with a patch plugin for all releases since 2017.1, and recommends restricting external access until updates can be applied.
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
Arista Networks has disclosed a critical vulnerability in the on-premises version of its VeloCloud Orchestrator product used for centralized SD-WAN management. The flaw, tracked as CVE-2026-16812, is an OS command injection issue that allows remote attackers to compromise the system without any authentication. Exploitation has already been confirmed, and the vulnerability carries the maximum CVSS base score of 10.0 in both version 4.0 and 3.1, classifying it as Critical. Successful attacks can impact the confidentiality, integrity, and availability of the orchestrator and all managed data. In addition, a compromised VeloCloud Orchestrator instance may grant attackers access to connected VeloCloud Edge devices across the network.
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-16812 affects the on-premises version of Arista VeloCloud Orchestrator and allows OS command injection that can lead to data leakage, tampering, and denial of service. The flaw carries a maximum CVSS v3.1 base score of 10.0 and is rated Critical. CVE-2025-68686 impacts Fortinet FortiOS and can be used to bypass specific patches and steal sensitive information when combined with another vulnerability that grants prior filesystem access. Federal agencies must remediate the VeloCloud issue by July 30 and the FortiOS issue by August 10.
Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
Multiple serious vulnerabilities have been disclosed in OpenAM, including remote code execution flaws that require no authentication. The Open Identity Platform development team released OpenAM 16.1.2 on July 20, 2026, addressing a total of 18 issues that encompass both native vulnerabilities and those in third-party dependencies. CVE-2026-62379 allows arbitrary Java classes specified in XML to be loaded and instantiated without validation, enabling unauthenticated remote code execution. CVE-2026-62263 stems from improper deserialization filtering in Java, similarly permitting unauthenticated code execution. The update also resolves an XSS vulnerability (CVE-2026-62280) on the authorization consent page and fixes issues in components such as Node.js, js-yaml, and websocket-driver. CVSS scores rate the two primary flaws as critical at 9.8 and 9.2 respectively.
Russian State-Supported Group LAUNDRY BEAR Exploits Zero-Day CVE-2025-66376 in Zimbra Collaboration Suite
Synacor’s Zimbra Collaboration Suite was targeted in a zero-day campaign by the Russian state-backed threat actor known as LAUNDRY BEAR. The stored cross-site scripting flaw in the webmail stylesheet handler allowed attackers to steal past emails simply by having victims view a specially crafted HTML message. No user interaction beyond opening the email was required for JavaScript execution in the browser. On 23 July 2026, sixteen countries including the United States, European nations and Australia issued a joint advisory signed by twenty-seven agencies such as NSA, FBI and CISA. The vulnerability received CVE-2025-66376 and a CVSS v3.1 base score of 7.2, rated High. Analysts assess the campaign focused on intelligence collection against Western government and corporate targets.
IPA Reports Record High Fake Warning Scam Consultations in Q2 2026
The Information Processing Promotion Agency (IPA) recorded 3,832 personal security consultations in the second quarter of 2026, marking an 8.5 percent increase from the previous quarter. Fake warning scams, which display fabricated malware alerts to frighten users into contacting fraudsters, rose sharply to 1,428 cases, a 23.7 percent jump and the highest figure in two years. These scams carry risks of financial loss and device compromise through fake support services. Consultations dipped temporarily after arrests in May 2025 but have now exceeded levels seen before those arrests. Phishing reports also increased slightly to 146 cases, including schemes impersonating the National Tax Agency. The trend of rising fake warning incidents has continued for three consecutive quarters, underscoring the need for ongoing public vigilance.
Google Releases Fifth Chrome Security Update in July, Addressing Four High-Severity Vulnerabilities
Google has issued the fifth security update for its Chrome browser in July 2026, releasing patches for four high-severity vulnerabilities. The update, published on July 23, 2026, includes versions Chrome 150.0.7871.187 and 150.0.7871.186 for Windows and macOS, along with Chrome 150.0.7871.186 for Linux. This follows previous July updates that fixed 27 issues on July 8, 15 on July 14, 7 on July 16, and 12 on July 21. The four newly addressed flaws, reported between late May and mid-June, all carry a High severity rating. They include an out-of-bounds write vulnerability in the codec component tracked as CVE-2026-16807, plus three Use After Free issues in WebMCP (CVE-2026-16806), the Blink rendering engine (CVE-2026-16805), and input processing (CVE-2026-16804).
Dell Releases Security Update for PowerProtect Data Manager Fixing 359 Vulnerabilities
Dell has issued a security update for its data protection solution Dell PowerProtect Data Manager to address a total of 359 vulnerabilities. The company published security advisory DSA-2026-287 on July 14, 2026, rating the issues as Critical and urging users to apply the fixes immediately. Six product-specific flaws were resolved, including CVE-2026-40712 in the REST API that allows privilege escalation after input validation bypass and CVE-2026-49499 stemming from improper security token generation. The remaining four native vulnerabilities received CVSS v3.1 base scores between 6.0 and 7.2. In addition, 353 third-party component vulnerabilities were patched, covering 130 issues in the Linux kernel along with flaws in Apache Log4j, Apache Tomcat, Samba, PostgreSQL, OpenSSL, glibc, and Vim. Administrators are advised to upgrade to version 20.2.0.0 or later to mitigate the risks.
Check Point Management Products Affected by High-Severity Authentication Bypass Vulnerability CVE-2026-16232 Already Under Active Exploitation
Check Point Software Technologies has disclosed a high-severity vulnerability in its security management products that allows attackers to bypass authentication and gain administrator privileges. The flaw, tracked as CVE-2026-16232, resides in the SmartConsole login process and affects the Management Server when accessed over the network. The company published its security advisory on July 19, 2026, confirming that exploitation has already been observed in the wild. Successful attacks could enable unauthorized changes to security configurations and policies. Impacted software includes R82.10, R82, R81.20, and multiple unsupported versions starting from R77.30. Organizations are urged to investigate potential breaches and apply available mitigations promptly.
CISA Adds SharePoint and Check Point SmartConsole Flaws to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. CVE-2026-50522 affects Microsoft SharePoint and allows remote code execution through untrusted data deserialization, carrying a CVSS v3.1 base score of 9.8. A patch was released on July 14, 2026, though exploitation was not observed at the time of disclosure. CVE-2026-16232 impacts Check Point Software Technologies SmartConsole and stems from an authentication bypass that could let attackers obtain administrative privileges and alter security policies. CISA has directed federal agencies to remediate both issues by July 25, 2026, and Check Point has published associated malicious IP addresses. The agency warns that the flaws pose a broad exploitation risk beyond government systems.
Oracle Releases Quarterly Critical Patch Update Addressing 1449 Vulnerabilities Across Numerous Products
Oracle has issued its regular quarterly Critical Patch Update on July 21, 2026, delivering fixes for a total of 1449 vulnerabilities. After removing duplicates, the update covers 1235 unique CVEs and impacts a broad range of products including Oracle Database Server, Oracle Java SE, Oracle MySQL, Oracle Fusion Middleware, Oracle WebLogic Server, and many others. Among the fixes, 261 vulnerabilities received CVSS base scores of 9.0 or higher, with ten rated at the maximum score of 10.0. Additionally, 1024 issues scored 7.0 or above, and 663 vulnerabilities can be exploited remotely without authentication. The advisory provides detailed guidance for administrators to apply the patches promptly across enterprise environments.
Mozilla Releases Firefox 153 Fixing 63 Vulnerabilities Including Critical ESR Issues
Mozilla Foundation released Firefox 153 on July 21, 2026, addressing a total of 63 vulnerabilities tracked under CVE identifiers. The update also covers the Firefox ESR branch, where several flaws already had public exploit code available, earning a Critical severity rating. Among the High-severity issues resolved are same-origin policy bypasses in navigation handling such as CVE-2026-16349 and multiple memory-safety problems. The release further patches Use-After-Free vulnerabilities including CVE-2026-16362 and several sandbox escape flaws designated CVE-2026-16351, CVE-2026-16352, CVE-2026-16356, and CVE-2026-16367. Additional fixes cover boundary condition errors, integer overflows, miscompilation issues, privilege escalation vectors, and information disclosure problems. In total the advisory lists 20 High, 35 Moderate, and 8 Low severity vulnerabilities that have been mitigated.
Adobe Issues 12 Security Advisories Addressing 89 Vulnerabilities Across Multiple Products
Adobe released 12 security advisories on July 14, 2026, addressing a total of 89 vulnerabilities in products including ColdFusion, Adobe Commerce, Experience Manager, Illustrator, and others. The updates align with Microsoft's Patch Tuesday schedule and cover critical flaws rated at the highest severity level. Several vulnerabilities in ColdFusion, Commerce, Experience Manager, and Illustrator received CVSS v3.1 base scores of 9.0 or higher. Adobe ColdFusion received the highest priority rating of 1, requiring remediation within 72 hours, while Adobe Commerce was assigned priority 2 with a 30-day update window. No active exploitation of the vulnerabilities had been observed at the time of disclosure. The advisories include dozens of specific CVE identifiers for each affected product line.
WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has issued version 7.0.2 along with other security releases on July 17, 2026, addressing two critical vulnerabilities identified as CVE-2026-63030 and CVE-2026-60137. When combined, these flaws enable remote attackers to execute arbitrary code on affected installations. CVE-2026-60137 stems from insufficient input validation in certain functions, potentially allowing SQL injection when processing untrusted data from plugins or themes. CVE-2026-63030 involves route interpretation confusion in the REST API batch endpoint, which can be leveraged alongside the SQL injection issue to achieve code execution. The vulnerabilities impact WordPress 6.8 and later branches, although chained attacks are not possible on the 6.8 series. Administrators are urged to apply the updates immediately to mitigate the risks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has released a new security update for its Chrome browser addressing seven vulnerabilities just two days after the previous patch. The update covers Windows, macOS, and Linux platforms with versions Chrome 150.0.7871.129 and 150.0.7871.128. Three of the issues, tracked as CVE-2026-15899, CVE-2026-15900, and CVE-2026-15901, received the highest severity rating of Critical and involve Use After Free flaws in CameraCapture, GPU, and Network components. Four additional High-severity vulnerabilities were also fixed, including an out-of-bounds access issue in the V8 JavaScript engine and Use After Free problems in Cast, Ozone, and Aura. The company plans to roll out the patches gradually over the coming days and weeks to all users.
CISA Adds Three Exploited Vulnerabilities in FortiSandbox and SharePoint to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. Two of the flaws affect Fortinet’s FortiSandbox malware analysis product and involve OS command injection issues that can be triggered via specially crafted HTTP requests without requiring authentication. The third vulnerability impacts Microsoft SharePoint and stems from unsafe deserialization of untrusted data, potentially allowing remote code execution over the network. CISA’s action follows public advisories released by the vendors in April and June 2026. The agency is urging organizations to apply available patches and mitigations immediately to reduce the risk of compromise.
CISA Urges Immediate Patching as Multiple SharePoint Server Vulnerabilities Confirmed Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory after confirming active exploitation of multiple vulnerabilities in Microsoft SharePoint Server. Four specific CVEs have been added to the Known Exploited Vulnerabilities (KEV) catalog, with one additional flaw flagged by Microsoft as high-risk even without confirmed exploitation. Successful attacks can lead to remote code execution, theft of Internet Information Services (IIS) machine keys, establishment of persistent access, and deployment of malware. CISA recommends applying the latest Microsoft patches immediately, verifying successful installation, enabling the Antimalware Scan Interface (AMSI), and strengthening monitoring through Microsoft Defender Antivirus. Organizations are also advised to avoid direct internet exposure of SharePoint servers and to implement Layer 7 reverse proxies with enhanced logging to reduce the attack surface.