July 2026 CVE Landscape

1. Executive summary

Insikt Group identified 85 high-impact vulnerabilities actively exploited or weaponized in July 2026, a 44% increase from June. Ten of these CVEs appear in the CISA KEV catalog with verified CVSS scores ranging from MEDIUM (4.3) to CRITICAL (10.0), covering products from Cisco IOS, Microsoft Office, Polkit, Langflow, Meta React Server Components, Fortinet FortiOS, SonicWall SMA1000, and others. Threat actor activity directly relevant to EMEA financial services includes Cloud Atlas (MITRE G0100) abusing Microsoft Equation Editor (CVE-2018-0802) to deliver CloudAtlasGo, and both JADEPUFFER and Cl0p targeting exposed AI and product-lifecycle platforms for data theft and extortion. The Dysphoria botnet is mass-exploiting legacy IoT and embedded device flaws to build DDoS and relay infrastructure, creating indirect risk for financial services through upstream service dependency disruption.

2. Regulatory framing

3. Technical analysis & attack chain

Prioritised triage table — KEV entries first, then by EPSS

Attack chains for the three most urgent entries

CVE-2018-0802 — Cloud Atlas delivering CloudAtlasGo (CONFIRMED, multi-source corroborated)

1. Cloud Atlas (MITRE G0100) crafts a malicious Microsoft Office document containing a crafted Equation Editor object.
2. Upon opening, the Equation Editor process (EQNEDT32.EXE) processes a malformed record, triggering an out-of-bounds write (CWE-787) in the stack.
3. The write overwrites return address control flow, redirecting execution to shellcode embedded in the document.
4. Shellcode downloads and executes the CloudAtlasGo payload — a Go-compiled implant providing C2 capabilities to the actor.
5. Persistence and C2 details for CloudAtlasGo are not specified in the source material.

CVE-2026-15409 — SonicWall SMA1000 SSRF (KEV, CVSS 10.0, EPSS 78%)

1. An unauthenticated attacker sends a crafted HTTP request to the SonicWall SMA1000 appliance's web management interface.
2. The request exploits a server-side request forgery vulnerability (CWE-918), causing the appliance to make arbitrary outbound requests from its trusted network position.
3. The attacker uses the SSRF to access internal services, cloud metadata endpoints, or other resources reachable from the appliance's vantage point — bypassing perimeter controls.
4. No specific threat actor attribution is provided in the source for this CVE. Public PoC status: not listed as having a PoC in the source table.

CVE-2026-0770 — Langflow untrusted control sphere inclusion (KEV, CVSS 9.8, EPSS 56%)

1. An attacker sends a crafted request to a Langflow instance exposing the inclusion of functionality from an untrusted control sphere (CWE-829).
2. The request causes Langflow to load and execute attacker-controlled code or configuration, achieving remote code execution.
3. A public PoC exists for this CVE. The source links JADEPUFFER activity to "exposed AI platforms" — Langflow is an AI workflow tool and CVE-2026-55255 (another Langflow CVE) also appears in the table, indicating sustained targeting of this platform.
4. Specific exploitation steps beyond the vector description are not provided in the source.

Additional threat-actor activity (single-sourced; verify before enforcement)

All actor attributions below derive solely from the Recorded Future Insikt Group July 2026 CVE Landscape report. Where MITRE ATT&CK profiles do not exist, attribution is unconfirmed.

• Dysphoria botnet — No MITRE ATT&CK profile; attribution unconfirmed. Linked to exploitation of 12 CVEs (CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, CVE-2025-9528) targeting routers, gateways, cameras, and repeaters. Combines known RCE flaws with weak Telnet and SSH credentials to enrol devices into DDoS and relay infrastructure.
• Armored Likho — No MITRE ATT&CK profile; attribution unconfirmed. Used a malicious Windows shortcut file to deploy BusySnake Stealer. No specific CVE linkage provided.
• JADEPUFFER — No MITRE ATT&CK profile; attribution unconfirmed. Targeted exposed AI and product-lifecycle platforms for encryption, data theft, and extortion. No specific CVEs or IOCs provided.
• Cl0p — Targeted exposed AI and product-lifecycle platforms for encryption, data theft, and extortion. No specific CVEs or IOCs provided in this report.
• UAT-7810 — No MITRE ATT&CK profile; attribution unconfirmed. Exploited CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 to compromise Ruckus devices and expand the "LapDogs operational relay" network. Single-sourced; verify before enforcement.

Long-tail observations

• 57 of 85 vulnerabilities enable RCE.
• 60 of 85 have public PoC exploits or scanners.
• 14 of 85 are at least 5 years old; oldest is approximately 18 years old (CVE-2008-4128).
• Most common weakness classes: CWE-78 (OS Command Injection), CWE-434 (Unrestricted Upload), CWE-94 (Code Injection), CWE-502 (Deserialization).
• Fastest observed disclosure-to-exploitation: less than one day.

4. Mitigation & containment

P1 — Within 24 hours

1. CVE-2018-0802 (Microsoft Equation Editor): Disable Equation Editor by setting the registry key HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{0002CE02-0000-0000-C000-000000000046} with Compatibility Flags = 0x400 (DEACTIVATE). Deploy the Microsoft security update. Block .rtf and .doc attachments at the email gateway where business processes permit. EDR: alert on EQNEDT32.EXE spawning child processes (PowerShell, cmd.exe, wscript.exe).
2. CVE-2026-15409 (SonicWall SMA1000): Apply the vendor patch immediately. If patching is not possible within 24h, restrict access to the SMA1000 management interface to a dedicated management VLAN or VPN-only access. Block outbound connections from the SMA1000 appliance to internal metadata services (e.g., 169.254.169.254) and internal service ranges at the firewall level. Monitor appliance logs for unexpected outbound HTTP/HTTPS requests.
3. CVE-2026-0770 (Langflow): Apply the vendor patch. If Langflow is internet-facing, move it behind authenticated reverse proxy or restrict to internal-only access. Block the Langflow service port at the perimeter. EDR: monitor for unexpected child processes spawned by the Langflow service account.
4. CVE-2025-55182 (Meta React Server Components): Apply the vendor patch. If using Meta RSC packages, audit for deserialization of untrusted data paths. Block public internet access to development/staging environments running these components.
5. CVE-2021-4034 (Polkit): Apply the distro security update for polkit / pkexec. As a compensating control, remove SUID bit from pkexec (chmod 0755 /usr/bin/pkexec) — note this may break legitimate polkit functionality. EDR: alert on pkexec execution from non-root, non-sudo contexts.

P2 — Within 72 hours

6. CVE-2017-17215 (Huawei HG532): Identify all Huawei HG532 devices in the estate. If retired/legacy, isolate or decommission. Disable remote management (TR-064 / UPnP) on WAN interfaces. Change default Telnet and SSH credentials. Block TR-064 ports (port 7547 and related) at perimeter.
7. CVE-2025-68686 (Fortinet FortiOS): Apply the Fortinet security update. Review FortiOS configuration for information exposure paths. Restrict management interface access.
8. CVE-2021-27137 (DD-WRT): Identify all DD-WRT firmware deployments. Upgrade to patched firmware or replace with vendor-supported devices. Disable WAN-side administration.
9. CVE-2008-4128 (Cisco IOS): Identify all Cisco IOS devices. Apply the relevant Cisco advisory patch. Restrict management plane access to SSH/VPN only. This CVE is 18 years old — any device still vulnerable indicates a fundamental patch-management gap.
10. CVE-2023-4346 (KNX Protocol): Identify building automation systems using KNX Protocol Connection Authorization Option 1. Upgrade to a patched KNX stack or enforce Option 2 authorization. Segment KNX traffic from corporate and production networks.

P3 — Within 7 days

11. Dysphoria botnet surface reduction: Audit all embedded Linux devices (routers, gateways, cameras, repeaters) for the 12 CVEs linked to Dysphoria. Enforce strong, unique credentials on all Telnet and SSH services. Disable Telnet where SSH is available. Segment IoT/embedded device networks from financial processing environments.
12. Ruckus device hardening (UAT-7810): Patch CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 on all Ruckus APs, SmartZone, and ZoneDirector controllers. Disable unnecessary management interfaces. Monitor for unexpected relay traffic.
13. Long-tail patching: For the remaining 71 CVEs in the source table, prioritise by: (a) presence in the client estate, (b) internet-facing exposure, (c) RCE capability, (d) public PoC availability. Apply vendor patches per each vendor's advisory. The source notes 60 of 85 have public PoCs — treat all PoC-bearing CVEs as exploitable-on-demand.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are present in the provided source material. The source describes behaviours and tool names but does not provide machine-pivotable IOCs.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material names malware families (CloudAtlasGo, BusySnake Stealer) and threat actors but does not provide file hashes, distinctive strings, mutex names, registry keys, command-line flags, or network signatures that could be used to construct YARA or Sigma rules. The behavioural indicators in §5 should be implemented as EDR/SIEM correlation rules using the described process and network patterns.

CVE assessment

10 referenced CVEs — 9 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

Threat actor context

Inception · G0100 · aka Inception Framework, Cloud Atlas

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.

No MITRE ATT&CK profile for: Dysphoria, Armored Likho.

7. Sources

• Recorded Future Insikt Group, "July 2026 CVE Landscape," https://www.recordedfuture.com/blog/july-2026-cve-landscape, published 2026-08-07
• Recorded Future Insikt Group, "June 2026 CVE Landscape," https://www.recordedfuture.com/blog/june-2026-cve-landscape (contextual comparison only)

8. Adverse Trace position

This is a high-severity advisory. The volume (85 CVEs, 44% month-over-month increase), the concentration of CRITICAL KEV entries (CVE-2025-55182 at CVSS 10.0 / EPSS 100%, CVE-2026-15409 at CVSS 10.0 / EPSS 78%, CVE-2026-0770 at CVSS 9.8 / EPSS 56%), and the direct targeting of financial-sector-relevant platforms by named actors (Cloud Atlas via Equation Editor, Cl0p and JADEPUFFER against AI/PLM platforms) create an elevated risk profile for EMEA financial services. The presence of 14 CVEs older than 5 years still under active exploitation indicates systemic patch-lag that DORA Art. 24 resilience testing should surface. Attribution for Dysphoria, Armored Likho, JADEPUFFER, and UAT-7810 is unconfirmed (no MITRE ATT&CK profiles) and single-sourced to Insikt Group — verify before enforcement actions. Cloud Atlas (G0100) attribution is corroborated by MITRE. Adverse Trace will distribute a filtered subset of the 85-CVE list mapped to client asset inventories within 48 hours and will monitor for emergence of atomic IOCs related to CloudAtlasGo and BusySnake Stealer.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.