Cybersecurity researchers identified 85 high-impact vulnerabilities in July 2026 that require urgent remediation, marking a 44% increase from the previous month. Of these, 36 were assigned a "Very Critical" risk score by Insikt Group. The vulnerabilities affected products from 61 vendors, with Microsoft accounting for approximately 12% of the total.
The United States Cybersecurity and Infrastructure Security Agency (CISA) listed 26 of these vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog. An additional 55 were reported by vendors, and four were primarily discovered through honeypot data.
A significant portion of the identified flaws, 57 out of 85, allowed for remote code execution (RCE). These RCE vulnerabilities impacted a wide range of systems, including products from Microsoft, Fortinet, Langflow, ServiceNow, WordPress, and Joomla, as well as internet-facing security appliances and embedded network devices. Public proof-of-concept (PoC) exploits or scanners were found for 60 of the 85 vulnerabilities.
Common weakness classes observed in July 2026 included CWE-78 (OS Command Injection), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-94 (Code Injection), and CWE-502 (Deserialization of Untrusted Data).
Notably, 14 of the 85 vulnerabilities were at least five years old, with the oldest dating back approximately 18 years, highlighting the continued exploitation of long-unpatched weaknesses. Conversely, the fastest observed time from public disclosure to reported exploitation for a vulnerability was less than one day.
Several prominent threat actor groups and botnets were active in July 2026. The Dysphoria botnet was observed exploiting known vulnerabilities in IoT and embedded devices to establish DDoS and relay infrastructure. Specifically, Dysphoria leveraged CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, and CVE-2025-9528 to compromise routers, gateways, cameras, repeaters, and other embedded Linux devices.
Other observed campaigns included Cloud Atlas abusing Microsoft Equation Editor (CVE-2018-0802) to deliver CloudAtlasGo malware, and Armored Likho deploying BusySnake Stealer via malicious Windows shortcuts. JADEPUFFER and Cl0p were noted for targeting exposed AI and product-lifecycle platforms, focusing on encryption, data theft, and extortion.
Specific vulnerabilities with a "Very Critical" risk score of 99 include CVE-2008-4128 in Cisco IOS, CVE-2017-17215 in Huawei HG532, CVE-2018-0802 in Microsoft Office Equation Editor, CVE-2021-4034 in Polkit, and CVE-2021-27137 in DD-WRT. Newer vulnerabilities with the same critical score include CVE-2025-55182 in Meta React Server Components, CVE-2025-68686 in Fortinet FortiOS, CVE-2026-0770 in Langflow, and CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 Appliances. Microsoft SharePoint also featured prominently with CVE-2026-50522, CVE-2026-56164, and CVE-2026-58644 all rated 99.
