Analyst Guidance
This week's verified CVE coverage is limited to one explicitly identified vulnerability: Fastjson 1.x RCE (CVE-2026-16723) with active exploitation and a CVSS 9.0 score. Additional OT and IT advisories from CISA and Dark Reading reference multiple unpatched or recently patched vulnerabilities affecting authentication, RCE, and DoS across Weintek, Rockwell, Johnson Controls, MZ Automation, PTC, Active Directory, and Azure; however, these sources do not provide explicit CVE IDs in the available text summaries. Security teams should prioritize immediate remediation of Fastjson, request detailed advisories from CISA for the referenced OT products, and review vendor guidance for GitLab, PTC Windchill/FlexPLM, and Azure Automation configurations.
CVE Details & Remediation
How to read this report
🛡️Verified facts — NVD & CISA KEV
⏳Partially verified — awaiting NVD enrichment
🧠AI analysis — synthesis, verify before acting
🛡️Actionable · Verified facts
NVD-published · CISA KEV cross-checked🛡️CVE-2026-15409 – SonicWall SMA1000 Appliances ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS78% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for SonicWall SMA1000 Appliances as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-48282 – Adobe ColdFusion ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
Remediation Steps
- Apply the latest security patch from Adobe for ColdFusion path traversal vulnerability
- Implement input validation and sanitization on all file path parameters
- Restrict directory access permissions to the minimum required
- Review recent application logs for path traversal exploitation attempts
References:
🛡️CVE-2026-48558 – Simple-Help Simplehelp ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS11% · P96
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for SimpleHelp as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-50522 – Microsoft SharePoint ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS57% · P99
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Microsoft Sharepoint Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-0770 – Langflow ✓ NVD
CVSS9.8 NVD 3.0
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS53% · P99
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Langflow as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-63030 – WordPress Core ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS98% · P100
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for WordPress Core as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-25089 – Fortinet FortiSandbox ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS70% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor patch immediately per Fortinet's security advisory
References:
🛡️CVE-2026-39808 – Fortinet FortiSandbox ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS90% · P100
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Fortinet Fortisandbox as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-46817 – Oracle E-Business Suite ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS13% · P96
ActionPatch immediately
AffectedGovernment Transportation
Remediation Steps
- Apply the vendor security update for Oracle E-Business Suite as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-56164 – Microsoft SharePoint Server ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS18% · P97
ActionPatch immediately
AffectedGovernment Transportation
Remediation Steps
- Apply the vendor security update for Microsoft Sharepoint Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-48939 – Joomlic Icagenda ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS24% · P98
ActionPatch immediately
Remediation Steps
- Check CISA Known Exploited Vulnerabilities Catalog for iCagenda advisory
- Apply vendor patch for unrestricted file upload vulnerability
- Review upload directories for any suspicious or unexpected files
- Restrict file upload functionality to authenticated users with appropriate permissions
References:
🛡️CVE-2026-48908 – JoomShaper SP Page Builder ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS88% · P100
ActionPatch immediately
Remediation Steps
- Check CISA Known Exploited Vulnerabilities Catalog for JoomShaper advisory and patch details
- Apply vendor patch for unrestricted file upload vulnerability
- Audit filesystem for unauthorized files or modifications
- Implement upload restrictions and validate file types server-side
References:
🛡️CVE-2026-56291 – Balbooa Forms ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS76% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Balbooa Forms as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-56290 – Joomlack Page Builder ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS83% · P100
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Joomlack Page Builder as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-58644 – Microsoft SharePoint ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS5% · P91
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Microsoft SharePoint as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-16232 – Check Point SmartConsole ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS13% · P96
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Checkpoint Multi-Domain Security Management as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-45659 – Microsoft SharePoint Server ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS7% · P93
ActionPatch immediately
AffectedGovernment
Remediation Steps
- Apply Microsoft security update for SharePoint Server immediately
- Restrict Internet exposure of on-premises SharePoint Server instances using firewall rules and network segmentation
- Review access logs for indicators of compromise
- Enable enhanced logging and monitoring on affected SharePoint deployments
References:
🛡️CVE-2026-55255 – Langflow ✓ NVD
CVSS8.4 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS29% · P98
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Langflow Langflow as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2021-27137 – Dd-Wrt ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS16% · P97
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for DD-WRT DD-WRT as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-56155 – Microsoft Active Directory Federation Services ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedGovernment Transportation
Remediation Steps
- Apply the vendor security update for Microsoft Windows 10 1607 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2023-4346 – KNX Association KNX Protocol Connection Authorization Option 1 ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P56
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for KNX Association KNX Protocol Connection Authorization Option 1 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-15410 – SonicWall SMA1000 Appliances ✓ NVD
CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS76% · P99
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for SonicWall SMA1000 Appliances as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-60137 – WordPress Core ✓ NVD
CVSS5.9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS78% · P100
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Wordpress as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2008-4128 – Cisco IOS ✓ NVD
CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS33% · P98
ActionPatch immediately
AffectedGovernment Energy
Remediation Steps
- Check CISA Known Exploited Vulnerabilities Catalog for Cisco advisory and patch information
- Apply vendor patch from Cisco Security Advisories
- Verify Cisco IOS version after patching
- Monitor for signs of unauthorized access or configuration changes on affected devices
References:
🛡️CVE-2026-16723 – Fastjson 1.x (Alibaba JSON library for Java) ✓ NVD
CVSS9 NVD 3.1
Triage statusNo Known Exploit
ExploitationNo exploitation reported ● New this week
EPSS<1% · P34
ActionPatch within 48 hours
Remediation Steps
- Immediately inventory all Spring Boot applications using Fastjson 1.x in production
References:
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.