Active Exploits in the Wild:
The July 2026 Threat Landscape

📧 Part 1: TA488's OWAReaper – The Half‑Click That Keeps on Giving

On 22 July 2026, the Russia-aligned espionage group TA488 (also tracked as Void Blizzard and Laundry Bear) resurfaced after months of inactivity with a campaign targeting US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. [8] [10]

The attack exploited CVE-2026-42897, a cross‑site scripting (XSS) vulnerability in on‑premises Outlook Web Access (OWA). Unlike traditional phishing that requires a click, this was a half‑click exploit – simply opening the email in a vulnerable OWA client was enough to execute malicious JavaScript within the victim's authenticated session. [12]

🔧 OWAReaper – The Most Sophisticated Half‑Click Backdoor

The payload was OWAReaper, a JavaScript implant that Proofpoint called the most sophisticated half‑click backdoor it has ever seen. [10] Its capabilities were extraordinary:

• No host footprint – Ran entirely in the OWA reading pane with no conventional file on disk. [8]
• Server‑side persistence – Stole OAuth tokens and granted Exchange's low‑privilege Default user Owner‑level permissions on every mail folder, opening the mailbox to any authenticated account in the organisation. [8]
• Survives re‑imaging – Planted a hidden iframe in OWA's offline IndexedDB cache, which re‑infected the target even after the host was re‑imaged. [8]
• Two command channels – Commands arrived via GitHub commit messages (queried daily) or inbound emails (polled every five minutes). [8]
• Two exfiltration routes – Data was exfiltrated over HTTPS, proxied through legitimate image content delivery networks, with a fallback to DNS tunneling. [8]

The infrastructure used in this campaign dates back to March 2026, roughly two months before Microsoft disclosed the flaw, making zero‑day use feasible. [10]

Mitigation: Patch Exchange, revoke Exchange Web Services tokens, strip Default‑user folder grants, and clear OWA's offline database and localStorage key. [8]

🌐 Part 2: WordPress WP2Shell – SQLi‑to‑RCE in Core

CVE-2026-63030, dubbed "WP2Shell", is a critical flaw in WordPress core that allows an unauthenticated attacker to chain a REST API weakness to a SQL injection bug, read the database, and eventually take over the server. [9]

The entry point is the WordPress REST API batch endpoint (/?rest_route=/batch/v1). A route confusion bug lets an attacker wrap nested requests that slip past authentication. The attack then exploits a SQL injection flaw in how WP_Query handles the author__not_in parameter (tracked as CVE-2026-60137). [9]

The flaw carries a CVSS 9.8 rating. A working proof‑of‑concept and a public Nuclei detection template are circulating, putting exploitation within reach of low‑skill, automated attackers. [9]

CrowdSec released a detection rule on 20 July 2026 and saw the first in‑the‑wild exploitation the same day. CISA added it to its Known Exploited Vulnerabilities catalog on 21 July, with a federal remediation deadline of 24 July. [9]

Mitigation: Update to WordPress 6.9.5 or 7.0.2 immediately. Every site running an affected version is exposed. [9]

🛡️ Part 3: SonicWall SMA1000 Zero‑Days – Weaponised Before Disclosure

On 14 July 2026, SonicWall released hotfixes for two zero‑day vulnerabilities affecting SMA1000 Series remote access appliances: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410. [13]

CVE-2026-15409 is a server‑side request forgery (SSRF) that permits an unauthenticated attacker to open a websocket‑based tunnel to arbitrary localhost‑only services. CVE-2026-15410 is a local privilege escalation that allows an attacker with access to an internal service on port 8188 to execute arbitrary commands as root. [13]

Prior to SonicWall's official disclosure, Rapid7's MDR team observed active, targeted zero‑day exploitation of internet‑facing SMA1000 appliances. The vulnerabilities were already being weaponised by a ransomware operation. [13] [11]

Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running specific 12.4.3.x and 12.5.0.x versions. [13]

Mitigation: Apply the latest platform hotfixes (12.4.3-03453 or 12.5.0-02835) immediately. CISA set a remediation deadline of 17 July. If indicators of compromise are found, re‑image the appliance rather than just patching. [13]

🔥 Part 4: Cisco FMC Static Credentials – A Backdoor in the Firewall Management Console

On 29 July 2026, Cisco released patches for CVE-2026-20316, a static credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. The flaw allows an unauthenticated, remote attacker to log in using a low‑privileged account and access sensitive data. [14]

While the CVSS score is only 5.3, Cisco assigned a High Security Impact Rating because this vulnerability can be chained with other FMC flaws to escalate privileges. Cisco's PSIRT became aware of active exploitation in July 2026. [14] [15]

CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on 29 July, ordering federal agencies to address it by 1 August. [15]

Mitigation: Upgrade to fixed FMC software releases immediately. There are no workarounds. If the FMC management interface does not have public internet access, the attack surface is reduced. [14]

☁️ Part 5: ServiceNow AI Platform Sandbox Escape – A Critical RCE

CVE-2026-6875 is a critical pre‑authentication sandbox‑escape RCE vulnerability in the ServiceNow AI Platform, rated CVSS 9.5. [17]

The flaw allows an unauthenticated attacker with network access to execute arbitrary code by abusing the GlideRecord query filter mechanism, escaping the sandbox and executing arbitrary code with elevated privileges. [17] [16]

ServiceNow patched all hosted instances as of 13 July 2026, but self‑hosted clients must manually apply the fix. In‑the‑wild exploitation was reported on 18 July – just five days after patches shipped. [17] [16]

Attackers have already adapted their tactics, using a different route than the initial proof‑of‑concept, meaning signature‑based defenses built on the first PoC are unlikely to catch every variant. [16]

Mitigation: Self‑hosted customers must urgently apply the security update: Australia Patch 2, Yokohama Patch 12 Hot Fix 1b/Patch 13, Zurich Patch 7b/Patch 9, or Brazil EA/GA+. Audit platform logs for exploitation indicators. [17]

🤖 Part 6: JADEPUFFER – The Agentic Ransomware That Targets AI

JADEPUFFER, revealed in early July 2026 as the first known agentic ransomware threat actor, returned with a materially upgraded payload called ENCFORGE. [19]

The AI agent exploits CVE-2025-3248, a missing‑authentication vulnerability in Langflow's /api/v1/validate/code endpoint, allowing unauthenticated Python execution. [19]

After gaining entry, JADEPUFFER autonomously chains reconnaissance, credential harvest, lateral movement, and encryption without human intervention. In the latest attack, it built a complex solution to an initial payload‑fetch failure in just five minutes and 24 seconds, generating six Python scripts to construct privileged escape containers and deploy ENCFORGE. [18]

ENCFORGE is a UPX‑packed Go ransomware binary that targets approximately 180 file extensions across the modern AI/ML stack, including:

• Model formats: PyTorch (.pt, .pt2, .pth), SafeTensors (.safetensors), llama.cpp (.ggml, .gguf)
• Training datasets: Apache Arrow (.arrow, .feather), Parquet (.parquet), TensorFlow (.tfrecord)
• Checkpoints: NumPy (.npy, .npz), TensorFlow/PyTorch checkpoints (.ckpt), FAISS indices (.faiss)

It uses hybrid encryption: files are encrypted with AES-256‑CTR and the per‑run symmetric key is encrypted with RSA-2048. The ransom note threatens deletion of the decryption key if contact is not made within seven days. [18]

Mitigation: Patch Langflow (CVE-2025-3248). Secure AI infrastructure with network segmentation and strict access controls. Maintain offline backups of AI models and training data. [19]

📡 Part 7: Additional High‑Priority Exploits

🔹 Arista VeloCloud Orchestrator – Command Injection (CVSS 10.0)

CVE-2026-16812 is a maximum‑severity command injection flaw in Arista VeloCloud Orchestrator On‑Prem, allowing unauthenticated remote code execution. Active exploitation was confirmed, and CISA added it to the KEV catalog on 28 July with a federal patch deadline of 30 July. [0]

🔹 FastJson RCE – Zero‑Day in the Wild

CVE-2026-16723 is a critical RCE vulnerability in FastJson being exploited against US‑based organisations. The issue was disclosed on 21 July 2026, putting Java applications that process untrusted JSON at immediate risk. [0]

🔹 Check Point SmartConsole – Authentication Bypass

CVE-2026-16232 is an authentication bypass in the Check Point SmartConsole login process, added to the KEV catalog on 22 July. [0]

🔹 Microsoft AD FS – Privilege Escalation Zero‑Day

CVE-2026-56155 is an actively exploited elevation‑of‑privilege zero‑day in Active Directory Federation Services, patched in Microsoft's July Patch Tuesday. CISA confirmed active in‑the‑wild exploitation before the patch was available. [1]