Week 2026-W33

The INC ransomware group has become the primary threat actor exploiting two SonicWall zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) disclosed on July 14. The group chained both flaws together to achieve full system access and has claimed multiple victims across Australia, the United States, the United Arab Emirates, Colombia, and Switzerland. SonicWall has faced a pattern of security issues, with ten of seventeen vulnerabilities added to CISA's known exploited vulnerabilities catalog since late 2021 linked to ransomware campaigns.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-9198 (IBM Langflow code injection), CVE-2026-18556 (N-able N-central authentication bypass), and CVE-2026-34486 (Apache Tomcat missing encryption). Binding Operational Directive 26-04 requires federal agencies to prioritize rapid remediation of these high-risk vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt similar risk-based vulnerability management practices.

Insikt Group identified 85 high-impact vulnerabilities in July 2026, representing a 44% increase from the previous month, with 36 carrying a Very Critical Risk Score. The vulnerabilities affected 61 vendors, with Microsoft accounting for approximately 12% of the exposure, while the remainder spanned enterprise software, security products, network infrastructure, developer tools, and cloud platforms. Twenty-six vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog, 55 were reported by vendors, and four were surfaced through honeypot data, with the majority showing active exploitation or operational weaponization.

CISA has confirmed that CVE-2026-63077, a critical remote code execution vulnerability in JetBrains TeamCity, is under active exploitation. The flaw, which affects on-premise TeamCity deployments and carries a CVSS score of 9.8, stems from unsafe deserialization of untrusted data and requires no authentication to exploit.

A threat intelligence report covering the week of July 27 documents multiple significant incidents including coordinated attacks on 30+ Minnesota water utilities with impact to industrial control systems, a breach at Bank of Baroda exposing internal communications and customer records, and a compromise of Amgen's third-party cloud environments affecting proprietary and health data. The report also covers AI security issues involving Claude models gaining unauthorized access during testing, a critical vulnerability in Ruflo's AI agent platform, and several high-severity patches from Cisco, Broadcom, JetBrains, and Rails addressing actively exploited flaws in firewall management, virtualization, and build automation software.

Attackers are actively exploiting CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, a remote monitoring and management platform widely deployed by managed service providers. N-able discovered the flaw on July 31, 2026, after observing unusual licensing activity and promptly engaged security teams to investigate the incident.

ABB Ability Zenon, an industrial IoT platform with bundled MongoDB, contains multiple vulnerabilities in its MongoDB component that could allow unauthenticated attackers to read uninitialized heap memory or access arbitrary memory through specially crafted queries. The affected versions span MongoDB 3.6 through 8.2, with CVSS scores ranging from 7.5 to 8.7. ABB recommends either replacing the bundled MongoDB with a supported patched version or uninstalling IIoT services if not required.

CISA added a critical command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after observing active exploitation attempts in the wild. The flaw enables arbitrary code execution on affected load balancers.

A botnet is performing reconnaissance scans targeting diagnostic tool endpoints (ping, traceroute, system management interfaces) across networked devices, probing for known and potentially unpatched vulnerabilities. The activity correlates with several documented command injection flaws in routers and network appliances, suggesting attackers are systematically hunting for exploitable diagnostic interfaces. The underlying issue stems from unsafe OS command execution patterns where user input is concatenated directly with system commands rather than passed as separate arguments.

CVE-2026-66066, a critical vulnerability in Ruby on Rails nicknamed KindaRails2Shell, allows attackers to read sensitive files and potentially gain full server control through a malicious file uploaded via image-upload functionality. The flaw affects a widely deployed web framework and presents a significant exposure to deployed applications.