Blackpoint CVE Analysis: July 2026 

Common Vulnerability Scoring System (CVSS) told us which July 2026 vulnerabilities looked scary on paper. Our APEX framework told us which ones needed a technician tonight, and the two lists were not the same. 

This month a vulnerability with a CVSS of 5.3 made our “right now” list; while a vulnerability with a CVSS of 9.9 did not. This is exactly the thing the APEX Wire helps with, helping teams prioritize which vulnerabilities need attention in a sea of CVEs and emerging threats.  

Why CVSS Alone Isn’t a Strategy 

July 2026 was a record month for vulnerability disclosure, with more than 15,000 reported between 01 July and 31 July 2026, an increase of 87% compared to June 2026. Of those, more than 45% were reported as critical or high severity, a 52% increase compared to June 2026. The significant increase is likely due to the adoption of AI models to identify vulnerabilities in software, leading to quicker identification.   

With more than 15,000 disclosed vulnerabilities, 11 made our “Flash” list. APG APEX was built for this gap, helping organizations focus on the vulnerabilities that require additional attention. CVSS tells you how severe a flaw could be, but it does not tell you whether it matters for an MSP running shared RMM tooling across dozens of client environments or an SMB with one IT admin and no segmentation. CVE Analysis is where we make that call publicly, every month, using the same framework our SOC uses internally.  

How APEX Makes the Call 

APEX weighs four signals against every vulnerability we track: 

  • Attacker interest, whether threat actors are using it, or publicly discussing it, right now 
  • Prevalence, how widely the affected software runs across MSP and SMB environments 
  • Exploitability, how much skill or access an attacker needs to pull it off 
  • eXposure, what’s at stake if it’s used against a managed environment, trust, access, backups, or continuity 

A high CVSS score with low attacker interest and high complexity can land in Routine. A moderate CVSS score with active exploitation and a foothold into shared infrastructure cannot. Below are the calls APG made against everything covered in our July 2026 Vulnerability Review. 

The Calls: 7 Right Now, 8 Routine 

“RIGHT NOW” does not mean these are the only vulnerabilities that matter this month. “ROUTINE” does not mean a vulnerability should be ignored or left unpatched indefinitely. 

A Routine call means the vulnerability does not currently warrant emergency patching based on available evidence at the time of publication. It should still be remediated during your normal maintenance cycle, unless your environment, exposure, or risk tolerance justifies a higher priority. Priorities change as exploitation, exposure, and operational context evolve. Routine today is not a permanent verdict. 

Application Infrastructure & Platforms 

RIGHT NOW CVE-2026-27690 – SAP Approuter – HTTP Request Smuggling  

There is no confirmed exploitation at the time of writing; however, at a CVSS 9.1, exploitation does not require authentication and sits directly in front of SAP-hosted business applications. An attacker can exploit specially crafted HTTP requests to access other users’ responses and trigger denial of service (DoS) conditions.  

RIGHT NOW CVE-2026-44747 – SAP NetWeaver Application Server (ABAP) – Memory Corruption  

A CVSS 9.9 in a software historically exploited that allows an authenticated attacker to exploit logic errors in memory management. While threat actors must be authenticated to exploit, this has historically not been a significant barrier for sophisticated and persistent threat groups.  

Data Protection & Recovery 

ROUTINE CVE-2026-50661 – Windows BitLocker – Security Feature Bypass  

This was publicly disclosed with a working bypass technique; however, exploitation is rated as “less likely” and it requires physical access to the device. This moves it to a fundamentally different attack surface than network reachable. A threat actor could bypass BitLocker Device Encryption and access encrypted data.  

RIGHT NOW CVE Pending – Progress ShareFile Storage Zone Controller – Path Traversal  

An authenticated administrative user can read arbitrary files, write attacker-controlled content to arbitrary directories, or enumerate the server’s filesystem layout. This was reported as a zero-day and Progress ordered customers to shut down on-premises servers over a “credible external security threat” before a patch was available.  

Network & Infrastructure 

RIGHT NOW CVE-2026-16232 – Check Point SmartConsole – Authentication Bypass  

Reported as a zero-day; CVSS 9.1. An unauthenticated attacker can obtain a SmartConsole application login token and use it to authenticate with full administrative privileges. This has been added to the CISA KEV Catalog and active exploitation was confirmed by Check Point.   

Productivity, Communications, & Business Applications 

RIGHT NOW CVE-2026-56164 – Microsoft SharePoint Server – Elevation of Privilege  

A CVSS 5.3; added to CISA KEV. Allows an unauthorized attacker to elevate privileges over a network without credentials; actively exploited; no details released. Despite a lower CVSS, this is an unauthenticated, zero-click privilege escalation confirmed under active exploitation. Additionally, attacker interest adds to the Right Now rating.  

RIGHT NOW CVE-2026-44761 – SAP Commerce Cloud – Default Credentials  

Default credentials allow attackers to obtain valid access tokens and read or modify data through exposed Commerce Cloud APIs. The vulnerable configuration ships with publicly documented sample credentials; exploitation requires almost no skill, making the barrier of entry nearly zero.   

Remote Access & Identity 

RIGHT NOW CVE-2026-40138 – BeyondTrust Remote Support & Privileged Remote Access (PRA) – Pre-Authentication Access Control Bypass  

Successful exploitation could allow an attacker to gain unauthorized access to the appliance, including accounts with elevated privileges. This vulnerability does require a specific authentication configuration; for organizations with the right configuration, the risk is significant.  

RIGHT NOW CVE-2026-40139 – BeyondTrust Remote Support & PRA – Pre-Authentication Access Control Bypass  

This vulnerability requires a specific authentication configuration to be enabled; however, a CVSS 9.2, unauthenticated bypass when the impacted configuration is enabled moves this to the Right Now list. This vulnerability could allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges 

ROUTINE CVE-2026-40140 – BeyondTrust Remote Support & PR) – Denial of Service  

An unauthenticated, remote attacker could trigger a DoS condition. Risk is limited to DoS condition, no path to data access or code execution. Additionally, there is no confirmed exploitation at the time of writing.  

ROUTINE CVE-2026-40141 – BeyondTrust Remote Support & PRA – Access Control Bypass  

Requires authentication to an account with specific, limited permissions to reach unintended resources. No confirmed exploitation at the time of writing.  

RIGHT NOW CVE-2026-56155 – Microsoft Active Directory Federation Services (AD FS) – Elevation of Privilege  

Allows an authenticated attacker to elevate privileges locally to administrative access. CVSS 7.8; confirmed actively exploited as a zero-day and added to CISA KEV. AD FS brokers single sign-on between on-premises AD and cloud services, which could provide the key to identity infrastructure.  

RIGHT NOW CVE-2026-15409 – SonicWall SMA1000 – Server-Side Request Forgery (SSRF)  

CVSS 10; CISA KEV; confirmed exploitation. A remote, unauthenticated attacker can force the SMA1000 appliance to issue requests to unintended internal or external locations. Can be chained with CVE-2026-15410 to gain full remote code execution on internet-facing SSL VPN gateways, with no user interaction required. SonicWall is the most frequently targeted SSL VPN as observed by the Blackpoint SOC in 2026.  

RIGHT NOW CVE-2026-15410 – SonicWall SMA1000 – Code Injection  

Allows an authenticated administrator to execute arbitrary operating system commands via the Appliance Management Console.  CVSS 7.2; but actively exploited. Chained with CVE-2026-15409 to achieve full remote code execution on vulnerable devices.  

Security & Threat Defense 

ROUTINE CVE-2026-59835 – Fortinet FortiSandbox – Unauthenticated VNC Exposure  

May allow an unauthenticated attacker to access the VNC server of virtual machines performing scanning via network requests. No confirmed exploitation at the time of writing. This vulnerability exposes the internal VM scanning sessions rather than the core administrative control of the appliance itself.   

ROUTINE CVE-2026-0280 – Palo Alto PAN-OS – Policy Bypass 

Impacts the User-ID Terminal Server Agent (TSA) component of PAN-OS. Low CVSS 1.7; no confirmed exploitation at the time of writing. Successful exploitation could enable bypassing firewall security policies.  

ROUTINE CVE-2026-0281 – Palo Alto PAN-OS – Information Disclosure  

Impacts the User-ID Terminal Server Agent (TSA) component of PAN-OS. Low CVSS 2.1; no confirmed exploitation at the time of writing. Successful exploitation could allow information disclosure through the management web interface.  

ROUTINE CVE-2026-0288 – Palo Alto PAN-OS – Buffer Overflow  

Impacts the User-ID Terminal Server Agent (TSA) component of PAN-OS. Could allow an unauthenticated attacker with network access to cause a DoS condition or potentially execute arbitrary code by sending specially crafted network traffic. Requires prior network access; no confirmed exploitation at the time of writing.  

Why This is High Importance for MSPs

Nearly every vulnerability on our Right Now list is infrastructure an MSP touches on behalf of many clients at once: remote access and identity products, like BeyondTrust or AD FS; network infrastructure products, like Check Point; and collaboration products like SharePoint. In a single-tenant environments, one exploited vulnerability results in one incident. In a managed environment, it’s that incident times every customer sharing the tool. That multiplier is why the APG APEX exists; it is not meant to replace a patch management program but to work alongside it to help prioritize which area require immediate attention.    

What’s Next 

This is the first release in our APEX Wire series. Every category above – Application Infrastructure & Platforms, Data Protection & Recovery, Network & Infrastructure, Production, Communications, & Business Applications, Remote Access & Identity, and Security & Threat Defense, will get its own deep dive as new vulnerabilities warrant it. Follow Blackpoint’s Adversary Pursuit Group for next month’s calls! 

References 

SAP NetWeaver:  

DATE PUBLISHEDAugust 17, 2026
AUTHORAndi Ursry

The 2AM Test

Executive Guide
Most MDR evaluations focus on dashboards, not what a provider actually does when something is live. Learn the four questions that matter more than the demo: authority, speed, surface coverage, and proof.
*88–91% of ransomware attacks land outside business hours

GET YOUR COPY