> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # July 2026 CVE Landscape - URL: https://f4n6.co.uk/security-feed/july-2026-cve-landscape/ - Published: 2026-08-07T22:58:00.000Z - Updated: 2026-08-07T22:58:00.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2008-4128, CVE-2017-17215, CVE-2018-0802, CVE-2021-4034, CVE-2021-27137, Dysphoria, Cloud Atlas, Armored Likho ## 1\. Executive summary Insikt Group identified 85 high-impact vulnerabilities actively exploited or weaponized in July 2026, a 44% increase from June. Ten of these CVEs appear in the CISA KEV catalog with verified CVSS scores ranging from MEDIUM (4.3) to CRITICAL (10.0), covering products from Cisco IOS, Microsoft Office, Polkit, Langflow, Meta React Server Components, Fortinet FortiOS, SonicWall SMA1000, and others. Threat actor activity directly relevant to EMEA financial services includes Cloud Atlas (MITRE G0100) abusing Microsoft Equation Editor (CVE-2018-0802) to deliver CloudAtlasGo, and both JADEPUFFER and Cl0p targeting exposed AI and product-lifecycle platforms for data theft and extortion. The Dysphoria botnet is mass-exploiting legacy IoT and embedded device flaws to build DDoS and relay infrastructure, creating indirect risk for financial services through upstream service dependency disruption. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | 85 high-impact vulnerabilities with active exploitation, including 10 CISA KEV entries with CVSS up to 10.0 — a volume and severity requiring formal classification of exposure as cyber threat intelligence. | Clients must classify exposure to KEV-listed CVEs (especially CRITICAL: CVE-2025-55182, CVE-2026-0770, CVE-2026-15409) within their ICT incident management process and determine if exploitation triggers major-incident reporting under Art. 19. | | DORA Art. 24: digital operational resilience testing — general requirements | Public PoCs exist for 60 of the 85 vulnerabilities, including for KEV entries CVE-2025-55182, CVE-2026-0770, and CVE-2018-0802, meaning exploit code is readily available to adversaries. | Resilience testing programmes must prioritise validation of patches and compensating controls against these specific CVEs where the affected products are in the client estate. | | NIS2 Art. 21(2)(d): supply chain security measures | Dysphoria botnet and UAT-7810 are compromising edge infrastructure (Ruckus, Tenda, TOTOLINK, Huawei, DrayTek) via legacy CVEs — devices commonly deployed in branch office and partner-network topologies. | In-scope organisations must assess whether compromised edge devices in their supply chain or branch topology could serve as ingress points to core financial networks. | ## 3\. Technical analysis & attack chain ### Prioritised triage table — KEV entries first, then by EPSS | CVE | Component | CVSS | KEV / EPSS | Why it matters | | -------------- | -------------------------------- | ------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2021-4034 | Polkit (pkexec) | 7.8 HIGH | KEV / 95% | Local privilege escalation to root on any Linux with default polkit. Trivially exploitable. | | CVE-2018-0802 | Microsoft Office Equation Editor | 7.8 HIGH | KEV / 87% | Actively used by Cloud Atlas (G0100) to deliver CloudAtlasGo via malicious documents. Direct financial-sector targeting. | | CVE-2017-17215 | Huawei HG532 router | 8.8 HIGH | Not KEV / 79% | Dysphoria botnet enrolment vector. Embedded device RCE via improper input validation. | | CVE-2026-15409 | SonicWall SMA1000 | 10.0 CRITICAL | KEV / 78% | SSRF on secure access gateway — direct path through perimeter to internal services. | | CVE-2026-0770 | Langflow | 9.8 CRITICAL | KEV / 56% | Inclusion of functionality from untrusted control sphere on AI workflow platform. Public PoC exists. JADEPUFFER targeting AI platforms. | | CVE-2008-4128 | Cisco IOS | 4.3 MEDIUM | KEV / 33% | 18-year-old CSRF on IOS — persistent legacy exposure in network infrastructure. | | CVE-2021-27137 | DD-WRT | 8.1 HIGH | KEV / 16% | Stack-based buffer overflow (CWE-121) in embedded firmware. Dysphoria-linked. | | CVE-2025-55182 | Meta React Server Components | 10.0 CRITICAL | KEV / 100% | Deserialization of untrusted data (CWE-502). Public PoC. Dysphoria-linked. Maximum EPSS. | | CVE-2025-68686 | Fortinet FortiOS | 5.9 MEDIUM | KEV / 1% | Exposure of sensitive information on firewall OS. | | CVE-2023-4346 | KNX Protocol | 7.5 HIGH | KEV / 1% | Authorization bypass (CWE-645) in building automation protocol. | ### Attack chains for the three most urgent entries ### CVE-2018-0802 — Cloud Atlas delivering CloudAtlasGo (CONFIRMED, multi-source corroborated) 1. Cloud Atlas (MITRE G0100) crafts a malicious Microsoft Office document containing a crafted Equation Editor object. 2. Upon opening, the Equation Editor process (`EQNEDT32.EXE`) processes a malformed record, triggering an out-of-bounds write (CWE-787) in the stack. 3. The write overwrites return address control flow, redirecting execution to shellcode embedded in the document. 4. Shellcode downloads and executes the CloudAtlasGo payload — a Go-compiled implant providing C2 capabilities to the actor. 5. Persistence and C2 details for CloudAtlasGo are not specified in the source material. ### CVE-2026-15409 — SonicWall SMA1000 SSRF (KEV, CVSS 10.0, EPSS 78%) 1. An unauthenticated attacker sends a crafted HTTP request to the SonicWall SMA1000 appliance's web management interface. 2. The request exploits a server-side request forgery vulnerability (CWE-918), causing the appliance to make arbitrary outbound requests from its trusted network position. 3. The attacker uses the SSRF to access internal services, cloud metadata endpoints, or other resources reachable from the appliance's vantage point — bypassing perimeter controls. 4. No specific threat actor attribution is provided in the source for this CVE. Public PoC status: not listed as having a PoC in the source table. ### CVE-2026-0770 — Langflow untrusted control sphere inclusion (KEV, CVSS 9.8, EPSS 56%) 1. An attacker sends a crafted request to a Langflow instance exposing the inclusion of functionality from an untrusted control sphere (CWE-829). 2. The request causes Langflow to load and execute attacker-controlled code or configuration, achieving remote code execution. 3. A public PoC exists for this CVE. The source links JADEPUFFER activity to "exposed AI platforms" — Langflow is an AI workflow tool and CVE-2026-55255 (another Langflow CVE) also appears in the table, indicating sustained targeting of this platform. 4. Specific exploitation steps beyond the vector description are not provided in the source. ### Additional threat-actor activity (single-sourced; verify before enforcement) All actor attributions below derive solely from the Recorded Future Insikt Group July 2026 CVE Landscape report. Where MITRE ATT&CK profiles do not exist, attribution is unconfirmed. - **Dysphoria botnet** — No MITRE ATT&CK profile; attribution unconfirmed. Linked to exploitation of 12 CVEs (CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, CVE-2025-9528) targeting routers, gateways, cameras, and repeaters. Combines known RCE flaws with weak Telnet and SSH credentials to enrol devices into DDoS and relay infrastructure. - **Armored Likho** — No MITRE ATT&CK profile; attribution unconfirmed. Used a malicious Windows shortcut file to deploy BusySnake Stealer. No specific CVE linkage provided. - **JADEPUFFER** — No MITRE ATT&CK profile; attribution unconfirmed. Targeted exposed AI and product-lifecycle platforms for encryption, data theft, and extortion. No specific CVEs or IOCs provided. - **Cl0p** — Targeted exposed AI and product-lifecycle platforms for encryption, data theft, and extortion. No specific CVEs or IOCs provided in this report. - **UAT-7810** — No MITRE ATT&CK profile; attribution unconfirmed. Exploited CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 to compromise Ruckus devices and expand the "LapDogs operational relay" network. Single-sourced; verify before enforcement. ### Long-tail observations - 57 of 85 vulnerabilities enable RCE. - 60 of 85 have public PoC exploits or scanners. - 14 of 85 are at least 5 years old; oldest is approximately 18 years old (CVE-2008-4128). - Most common weakness classes: CWE-78 (OS Command Injection), CWE-434 (Unrestricted Upload), CWE-94 (Code Injection), CWE-502 (Deserialization). - Fastest observed disclosure-to-exploitation: less than one day. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **CVE-2018-0802 (Microsoft Equation Editor):** Disable Equation Editor by setting the registry key `HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{0002CE02-0000-0000-C000-000000000046}` with `Compatibility Flags = 0x400` (DEACTIVATE). Deploy the Microsoft security update. Block `.rtf` and `.doc` attachments at the email gateway where business processes permit. EDR: alert on `EQNEDT32.EXE` spawning child processes (PowerShell, cmd.exe, wscript.exe). 2. **CVE-2026-15409 (SonicWall SMA1000):** Apply the vendor patch immediately. If patching is not possible within 24h, restrict access to the SMA1000 management interface to a dedicated management VLAN or VPN-only access. Block outbound connections from the SMA1000 appliance to internal metadata services (e.g., `169.254.169.254`) and internal service ranges at the firewall level. Monitor appliance logs for unexpected outbound HTTP/HTTPS requests. 3. **CVE-2026-0770 (Langflow):** Apply the vendor patch. If Langflow is internet-facing, move it behind authenticated reverse proxy or restrict to internal-only access. Block the Langflow service port at the perimeter. EDR: monitor for unexpected child processes spawned by the Langflow service account. 4. **CVE-2025-55182 (Meta React Server Components):** Apply the vendor patch. If using Meta RSC packages, audit for deserialization of untrusted data paths. Block public internet access to development/staging environments running these components. 5. **CVE-2021-4034 (Polkit):** Apply the distro security update for `polkit` / `pkexec`. As a compensating control, remove SUID bit from `pkexec` (`chmod 0755 /usr/bin/pkexec`) — note this may break legitimate polkit functionality. EDR: alert on `pkexec` execution from non-root, non-sudo contexts. ### P2 — Within 72 hours 1. **CVE-2017-17215 (Huawei HG532):** Identify all Huawei HG532 devices in the estate. If retired/legacy, isolate or decommission. Disable remote management (TR-064 / UPnP) on WAN interfaces. Change default Telnet and SSH credentials. Block TR-064 ports (port 7547 and related) at perimeter. 2. **CVE-2025-68686 (Fortinet FortiOS):** Apply the Fortinet security update. Review FortiOS configuration for information exposure paths. Restrict management interface access. 3. **CVE-2021-27137 (DD-WRT):** Identify all DD-WRT firmware deployments. Upgrade to patched firmware or replace with vendor-supported devices. Disable WAN-side administration. 4. **CVE-2008-4128 (Cisco IOS):** Identify all Cisco IOS devices. Apply the relevant Cisco advisory patch. Restrict management plane access to SSH/VPN only. This CVE is 18 years old — any device still vulnerable indicates a fundamental patch-management gap. 5. **CVE-2023-4346 (KNX Protocol):** Identify building automation systems using KNX Protocol Connection Authorization Option 1\. Upgrade to a patched KNX stack or enforce Option 2 authorization. Segment KNX traffic from corporate and production networks. ### P3 — Within 7 days 1. **Dysphoria botnet surface reduction:** Audit all embedded Linux devices (routers, gateways, cameras, repeaters) for the 12 CVEs linked to Dysphoria. Enforce strong, unique credentials on all Telnet and SSH services. Disable Telnet where SSH is available. Segment IoT/embedded device networks from financial processing environments. 2. **Ruckus device hardening (UAT-7810):** Patch CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 on all Ruckus APs, SmartZone, and ZoneDirector controllers. Disable unnecessary management interfaces. Monitor for unexpected relay traffic. 3. **Long-tail patching:** For the remaining 71 CVEs in the source table, prioritise by: (a) presence in the client estate, (b) internet-facing exposure, (c) RCE capability, (d) public PoC availability. Apply vendor patches per each vendor's advisory. The source notes 60 of 85 have public PoCs — treat all PoC-bearing CVEs as exploitable-on-demand. ## 5\. Indicators of compromise No atomic indicators of compromise (IPs, domains, hashes, URLs) are present in the provided source material. The source describes behaviours and tool names but does not provide machine-pivotable IOCs. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------- | | EQNEDT32.EXE spawning child processes (PowerShell, cmd.exe) after document open | EDR / process telemetry | High — consistent with CVE-2018-0802 exploitation by Cloud Atlas | | Malicious Windows shortcut (.lnk) execution leading to unfamiliar process | EDR / endpoint telemetry | Medium — linked to Armored Likho / BusySnake Stealer; single-sourced | | Outbound HTTP/HTTPS requests from SonicWall SMA1000 to internal IP ranges or cloud metadata endpoints | Firewall / network flow logs | High — consistent with CVE-2026-15409 SSRF exploitation | | Langflow service account spawning unexpected child processes | EDR / container telemetry | Medium — consistent with CVE-2026-0770 exploitation | | Embedded Linux devices (routers, cameras, repeaters) making unexpected outbound connections on non-standard ports | Network flow / NDR | Medium — consistent with Dysphoria botnet enrolment; single-sourced | | Ruckus devices generating unexpected relay traffic to unknown destinations | Network flow / NDR | Low — linked to UAT-7810 LapDogs relay; single-sourced, unconfirmed attribution | ## 6\. Detection Insufficient indicators to author detection rules. The source material names malware families (CloudAtlasGo, BusySnake Stealer) and threat actors but does not provide file hashes, distinctive strings, mutex names, registry keys, command-line flags, or network signatures that could be used to construct YARA or Sigma rules. The behavioural indicators in §5 should be implemented as EDR/SIEM correlation rules using the described process and network patterns. ## CVE assessment 10 referenced CVEs — **9 actively exploited (CISA KEV)**, 3 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2025-12-05 | 100% | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and… | | [CVE-2026-15409](https://nvd.nist.gov/vuln/detail/CVE-2026-15409?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-07-14 | 78% | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote… | | [CVE-2026-0770](https://nvd.nist.gov/vuln/detail/CVE-2026-0770?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-07-21 | 56% | Langflow exec\_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulner… | | [CVE-2021-27137](https://nvd.nist.gov/vuln/detail/CVE-2021-27137?ref=f4n6.co.uk) | 8.1 High | ⚠ KEV 2026-07-21 | 16% | An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724\. An unsafe strcpy in the UPnP handling functionality a… | | [CVE-2018-0802](https://nvd.nist.gov/vuln/detail/CVE-2018-0802?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2021-11-03 | 87% | Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remot… | | [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2022-06-27 | 95% | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool design… | | [CVE-2023-4346](https://nvd.nist.gov/vuln/detail/CVE-2023-4346?ref=f4n6.co.uk) | 7.5 High | ⚠ KEV 2026-07-15 | 1% | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to bein… | | [CVE-2025-68686](https://nvd.nist.gov/vuln/detail/CVE-2025-68686?ref=f4n6.co.uk) | 5.9 Medium | ⚠ KEV 2026-07-27 | 1% | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability \[CWE-200\] vulnerability in Fortinet FortiOS 7.6.0 t… | | [CVE-2008-4128](https://nvd.nist.gov/vuln/detail/CVE-2008-4128?ref=f4n6.co.uk) | 4.3 Medium | ⚠ KEV 2026-07-13 | 33% | Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 In… | | [CVE-2017-17215](https://nvd.nist.gov/vuln/detail/CVE-2017-17215?ref=f4n6.co.uk) | 8.8 High | — | 79% | Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send mali… | ## Threat actor context **Inception** · [G0100](https://attack.mitre.org/groups/G0100?ref=f4n6.co.uk) · aka Inception Framework, Cloud Atlas [Inception](https://attack.mitre.org/groups/G0100?ref=f4n6.co.uk) is a cyber espionage group active since at least 2014\. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East. *No MITRE ATT&CK profile for: Dysphoria, Armored Likho.* ## 7\. Sources - Recorded Future Insikt Group, "July 2026 CVE Landscape," https://www.recordedfuture.com/blog/july-2026-cve-landscape, published 2026-08-07 - Recorded Future Insikt Group, "June 2026 CVE Landscape," https://www.recordedfuture.com/blog/june-2026-cve-landscape (contextual comparison only) ## 8\. Adverse Trace position This is a high-severity advisory. The volume (85 CVEs, 44% month-over-month increase), the concentration of CRITICAL KEV entries (CVE-2025-55182 at CVSS 10.0 / EPSS 100%, CVE-2026-15409 at CVSS 10.0 / EPSS 78%, CVE-2026-0770 at CVSS 9.8 / EPSS 56%), and the direct targeting of financial-sector-relevant platforms by named actors (Cloud Atlas via Equation Editor, Cl0p and JADEPUFFER against AI/PLM platforms) create an elevated risk profile for EMEA financial services. The presence of 14 CVEs older than 5 years still under active exploitation indicates systemic patch-lag that DORA Art. 24 resilience testing should surface. Attribution for Dysphoria, Armored Likho, JADEPUFFER, and UAT-7810 is unconfirmed (no MITRE ATT&CK profiles) and single-sourced to Insikt Group — verify before enforcement actions. Cloud Atlas (G0100) attribution is corroborated by MITRE. Adverse Trace will distribute a filtered subset of the 85-CVE list mapped to client asset inventories within 48 hours and will monitor for emergence of atomic IOCs related to CloudAtlasGo and BusySnake Stealer. --- [Read the original source →](https://www.recordedfuture.com/blog/july-2026-cve-landscape?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*