A new report from Eclypsium, titled InfraTrust Pulse, has identified critical vulnerabilities in infrastructure, firmware, networking, and edge devices that organizations should prioritize for patching. The inaugural July 2026 report, part of Eclypsium's new InfraTrust knowledge base, analyzed 61 infrastructure advisories from 14 vendors, highlighting six critical advisories and 26 remotely exploitable, unauthenticated vulnerabilities.
The report emphasizes prioritizing vulnerabilities based on exploitability, exposure, and real-world risk rather than solely relying on severity scores. This approach is particularly relevant given the increasing targeting of network edge devices by state-sponsored threat actors, such as Volt Typhoon and Salt Typhoon, who have exploited flaws in routers, VPNs, and firewalls to breach critical infrastructure.
Among the advisories Eclypsium recommends prioritizing are those affecting internet-exposed infrastructure, those already under active exploitation, or those that can be compromised remotely without authentication.
Specifically, the report highlights two actively exploited vulnerabilities in SonicWall SMA1000 remote-access appliances, tracked as CVE-2026-15409 and CVE-2026-15410. Attackers were reportedly exploiting these flaws to install custom malware weeks before SonicWall's public disclosure and their addition to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Fortinet's FortiSandbox is also noted for two critical command injection vulnerabilities, CVE-2026-39808 and CVE-2026-25089, which were later added to CISA's KEV catalog on July 16, 2026, after exploitation was detected. Although these advisories (FG-IR-26-100 / FG-IR-26-141) were published before the report's 30-day window, Eclypsium included them due to the CISA listing and a federal remediation deadline of July 19 under BOD 26-04.
Dell advisories DSA-2026-240 and DSA-2026-317 address critical vulnerabilities in EMC Networking OS10 and SmartFabric Manager. The OS10 advisory alone includes hundreds of upstream fixes, underscoring the extensive attack surface of network operating systems, which are often full Linux distributions.
F5 BIG-IP application delivery controllers (ADCs) and load balancers are also flagged due to critical unauthenticated vulnerabilities (K000153397) affecting these internet-exposed devices, which frequently reside at the edge of enterprise networks.
Juniper Networks' Junos OS is affected by remotely exploitable flaws (JSA110083 and JSA110086) that could crash affected routers and switches, potentially leading to denial-of-service conditions.
Finally, NVIDIA's BlueField DPUs and ConnectX SmartNICs, used in AI and data-center infrastructure, have vulnerabilities addressed in NVIDIA Security Bulletin 5865.
The report also draws attention to the lagging update cycles for firmware and hardware components, which depend on hardware vendors to integrate and distribute security fixes. As an example, an HP Poly Video advisory for a Qualcomm GPU driver vulnerability (CVE-2026-21385) was released four months after the flaw was already exploited in attacks and added to CISA's KEV catalog.
Eclypsium's methodology focuses on tracking vendor advisories rather than individual CVEs, recognizing that a single infrastructure advisory can encompass dozens or even hundreds of vulnerabilities. The report highlights that an internet-reachable flaw with a lower CVSS score might pose a greater risk than a higher-scoring vulnerability requiring local administrator access.
