Report Date: 2026-07-28
New KEVs: 4 ▼ -3 vs last weekRansomware Victims: 268 ▲ +108 vs last week
4 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 268 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.
Patch This Week
The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.
- CVE-2026-50522 – Microsoft SharePoint | CVSS 9.8 | EPSS 57.1% / 99th pct
CISA deadline: 2026-07-25 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-16232 – Check Point SmartConsole | CVSS 9.1 | EPSS 12.7% / 96th pct
CISA deadline: 2026-07-25 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-16812 – Arista VeloCloud Orchestrator | CVSS 10.0 | EPSS 1.0% / 59th pct
CISA deadline: 2026-07-30 (2d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Top KEVs
Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.
This Reporting Window
- CVE-2026-16812 – Arista VeloCloud Orchestrator | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 1.0% / 59th pct | Ransomware Use: No
- CVE-2026-50522 – Microsoft SharePoint | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 57.1% / 99th pct | Ransomware Use: No
- CVE-2026-16232 – Check Point SmartConsole | CVSS 9.1 (CRITICAL) | AV: Network | EPSS 12.7% / 96th pct | Ransomware Use: No
- CVE-2025-68686 – Fortinet FortiOS | CVSS 5.9 (MEDIUM) | AV: Network | EPSS 1.3% / 67th pct | Ransomware Use: No
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
- CISA ICS AdvisoryAdvisory · today – Siemens SIMATIC S7-PLCSIM Advanced
View CSAF Summary SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for pro… - CISA ICS AdvisoryAdvisory · today – igloohome Smart Lock Mobile Application
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. The following versions of igloohome Smart Lock Mobile Application are affected: S… - CISA ICS AdvisoryAdvisory · today – Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is prep… - SANS ISCResearch · today – AutoIT Payload Injector , (Tue, Jul 28th)
For a long time, AutoIT[1] has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful. Indeed, it can perform all the required actions to inject a pa… - SANS ISCResearch · 2 days ago – Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)
ESAFENET&#;x26;#;39;s CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and … - Unit 42Incident · 5 days ago – Russian Global Webmail Espionage
Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42 . - Unit 42Research · 11 days ago – Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Tri… - Sophos X-OpsResearch · today – Chaos in Teams vishing
Attackers used Microsoft Teams vishing, custom malware, and remote access tools to facilitate ransomware deployment Categories: Threat Research Tags: Microsoft Teams, vishing, Ransomware, Chaos - Sophos X-OpsResearch · yesterday – 2607-secai
<p>What that means for Customer Protections&nbsp;</p> Categories: Threat Research, AI Research - The RecordIncident · today – Indiaâs Bank of Baroda confirms cyber incident after hackers claim data theft
An employee's email account had been compromised, allowing unauthorized access to "certain data," Bank of Baroda reported. - The RecordIncident · yesterday – Health system in South Carolina, Georgia closes offices after malware affects networks
On Sunday, AnMed published a statement online saying they were âexperiencing a cybersecurity disruption involving malwareâ and were working to restore systems and determine the scope of the incident. - Security Affairs (APT)Incident · 2 days ago – Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Credentials
Hackers compromised hotel Wi-Fi gateways to redirect users to fake Microsoft 365 login pages and steal credentials. ReliaQuest’s threat research team just documented attackers compromising the Wi-Fi gateways at hot… - Security Affairs (APT)Incident · 3 days ago – Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems
US agencies warn Iran-linked actors are targeting internet-exposed water and energy control systems, risking disruption. Federal agencies updated their cybersecurity advisory this week: Iran-linked actors are inside Amer… - Security Affairs (Cybercrime)News · today – Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure
Researchers uncovered the 200,000-device Dysphoria botnet, which uses Ethereum and Solana domains to hide its command servers. QiAnXin XLab, jointly with China’s CNCERT, disclosed Dysphoria, a botnet that has compr… - Security Affairs (Cybercrime)Incident · today – New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
Proofpoint uncovered Cruciferra, a crypter-as-a-service that helps hackers evade antivirus and deliver malware in multiple campaigns. Proofpoint’s research team traced a wave of income-tax-themed lures targeting In…
Ransomware Activity
Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.
21 new victims posted today
7-day total: 268 via Ransomware.live
Infostealer Exposure: 17,952 employee credentials and 1,003,536 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.
Most Active Groups
Group Intelligence
- Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- Crpxo — CRPxO is actively recruiting affiliates, offering:
🔹 70% revenue share
🔹 XMR/BTC payouts
🔹 Claimed payouts within 24 hours
🔹 $333 one-time affiliate access
Most Targeted Sectors
Top Countries
US (109), DE (12), GB (11), IN (11), CA (11)
Notable Incidents
- BH Security, LLC. (brinkshome.com) (Professional Services · US) — claimed by Shinyhunters. Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the … Press coverage →
- Thialf (Energy & Utilities · NL) — claimed by Thegentlemen. ***.nl zoominfo.com/c/thialf/430686423 Thialf is a world-renowned ice arena located in Heerenveen, Netherlands, often referred to as the "Cathedral of Speed Skating." It serves as the home base for the Dutch national spe… Press coverage →
- greenecountyga.gov (Government & Defense · US) — claimed by Incransom. Greene County, Georgia is a historic and scenic county located in the east-central "Lake Country" region of the state, roughly halfway between Atlanta and Augusta. Established in 1786 as Georgia's 11th county, it is wide… Press coverage →
- Plitvička Jezera Nacionalni Park (Hospitality · HR) — claimed by Qilin. N/A Press coverage →
- Ernst & Young (Professional Services · US) — claimed by Shinyhunters. Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to release all the data and files. This is a final warning to … Press coverage →
Vendor-Specific Risks
Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.