Notifications
Clear all
Topic starter
18/08/2026 2:19 pm
TL;DR: July’s vulnerability trend data showed a split between high-noise issues and the flaws that actually reached CISA KEV, with wp2shell for WordPress and a SharePoint deserialization bug dominating attention while enterprise appliance and SaaS-edge issues often moved quietly, according to Intruder. The pattern reinforces that exposure management needs continuous validation, because attacker focus rarely matches social chatter.
NHIMG editorial — based on content published by Intruder: July’s exploited vulnerabilities and what trended in July 2026
By the numbers:
- The wp2shell WordPress chain affected WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1, with active exploitation confirmed after it entered CISA KEV on 21 July 2026.
- CVE-2026-50522 was published on NVD almost a year to the day after ToolShell, another unauthenticated SharePoint deserialization flaw in the same product.
- Windows AppLocker CVE-2024-21338 trended with a cvemon hype score of 30, but it required low-privileged local code execution first.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities that appear in KEV lists?
A: Security teams should prioritise vulnerabilities by evidence of active exploitation, reachability in the running environment, and privilege impact.
Q: Why do some vulnerabilities matter more than the ones that trend the most?
A: Trending reflects attention, not attacker behaviour.
Q: How should organisations evaluate exploit chains in web applications?
A: They should look beyond the individual CVE and ask how request routing, query handling, authentication checks, and caching interact.
Practitioner guidance
- Prioritise KEV-listed assets first Build weekly remediation queues around CISA KEV entries and internet-facing services before addressing lower-signal findings from trend feeds.
- Map exploit chains, not isolated CVEs Assess whether two modest issues can combine into authentication bypass, state manipulation, or code execution on the same platform.
- Treat admin consoles as privileged identity surfaces Apply the same segmentation, authentication hardening, and privileged access review discipline to management planes that you use for sensitive IAM systems.
What's in the full article
Intruder's full monthly roundup covers the operational detail this post intentionally leaves for the source:
- Exact cvemon scoring and activity history for the July vulnerability set, including how the hype score was calculated
- Per-CVE breakdowns for the remaining KEV additions across Oracle, SonicWall, Fortinet, Adobe, Joomla, and SharePoint
- Patch timing and exploitability notes that help teams decide which internet-facing systems to triage first
- The live cvemon status references and monthly trend context behind each ranking
👉 Read Intruder’s monthly roundup of July’s exploited vulnerabilities and KEV additions →
Exploited July vulnerabilities: what security teams actually need to watch?
Explore further
18/08/2026 3:11 pm
Noise is not risk, exploitability is. July’s roundup shows why security teams should treat KEV membership as a higher-value operational signal than trending volume. Social attention often clusters around mass-market software, but attackers prioritise reachable systems with direct exploitation paths. The practical conclusion is simple: exposure programmes must rank by active abuse, not by how loudly a bug circulates.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records.
A question worth separating out:
Q: Who is accountable when an exposed access appliance is exploited?
A: Accountability usually spans infrastructure operations, security operations, and the identity team when the appliance brokers authentication or access policy. The organisation needs a clear owner for exposure monitoring, emergency isolation, patch timing, and post-incident verification. Access infrastructure cannot sit in an ownership gap if it forms part of the trust boundary.
👉 Read our full editorial: July’s exploited vulnerabilities show why loud issues can hide the real risk
