Zero-day report: July 2026
CISA added 26 exploited vulnerabilities to its catalog in July 2026, 3 more than June (23). 13 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 5.
By technology
Most-hit vendors
Every flaw added in July 2026
- Cisco · Secure Firewall Management Center (FMC)Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
- Fortinet · FortiOSFortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Arista · VeloCloud OrchestratorArista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
- Check Point · SmartConsoleCheck Point SmartConsole Improper Authentication Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- DD-WRT · DD-WRTDD-WRT Stack-Based Buffer Overflow Vulnerability
- Langflow · LangflowLangflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- WordPress · CoreWordPress Core SQL Injection Vulnerability
- WordPress · CoreWordPress Core Interpretation Conflict Vulnerability
- Fortinet · FortiSandboxFortinet FortiSandbox OS Command Injection Vulnerability
- Fortinet · FortiSandboxFortinet FortiSandbox OS Command Injection Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- KNX Association · KNX Protocol Connection Authorization Option 1KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
- Oracle · E-Business SuiteOracle E-Business Suite Improper Privilege Management Vulnerability
- SonicWall · SMA1000 AppliancesSonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- SonicWall · SMA1000 AppliancesSonicWall SMA1000 Appliances Code Injection Vulnerability
- Microsoft · Active Directory Federation ServicesMicrosoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
- Microsoft · SharePoint ServerMicrosoft SharePoint Server Missing Authentication for Critical Function Vulnerability
- Cisco · IOSCisco IOS Cross-Site Request Forgery Vulnerability
- iCagenda · iCagendaiCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
- Balbooa · FormsBalbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Path Traversal Vulnerability
- JoomShaper · SP Page BuilderJoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Langflow · LangflowLangflow Authorization Bypass Through User-Controlled Key Vulnerability
- Joomlack · Page BuilderJoomlack Page Builder Improper Access Control Vulnerability
- Microsoft · SharePoint ServerMicrosoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.