Weekly Vulnerability Intelligence Brief: July 1 Week, 2026
Weekly Vulnerability Intelligence Brief: July 1 Week, 2026
Adobe ColdFusion Maximum-Severity Wave, Chrome 151's Record Patch Batch, Dual Microsoft Defender Zero-Days, and the SimpleHelp KEV Deadline
Coverage window: June 29 – July 5, 2026 Classification: Vulnerability Intelligence / Patch Advisory Audience: SOC analysts, vulnerability management teams, IT operations
Executive Summary
The first week of July 2026 produced an unusually dense disclosure cycle even by 2026 standards, where AI-assisted fuzzing has already pushed monthly CVE volumes into the hundreds. Seven separate advisories in this window carry a CVSS base score of 10.0, one of which was reverse-engineered and weaponized within roughly two hours of a public technical write-up. This brief consolidates the technical detail — CWE classifications, CVSS vectors, affected/fixed versions, and exploitation status — needed to triage patch order correctly.
| Priority | CVE(s) | Product | CVSS | Status as of July 5 |
|---|---|---|---|---|
| P0 | CVE-2026-48282 | Adobe ColdFusion 2023/2025 | 10.0 | KEV-listed, exploited in the wild |
| P0 | CVE-2026-48558 | SimpleHelp RMM | 10.0 | KEV, BOD 26-04 deadline July 2 |
| P0 | CVE-2026-48276/48277/48281/48283/48316 | Adobe ColdFusion | 10.0 (×5) | Not yet exploited at disclosure |
| P1 | CVE-2026-48286 | Adobe Campaign Classic (on-prem) | 10.0 | Not yet exploited at disclosure |
| P1 | CVE-2026-13028 | Google Chrome (WebGL) | 9.6 | Patched, no known exploitation |
| P1 | CVE-2026-33825 ("BlueHammer") | Microsoft Defender | Critical (EoP) | Confirmed in active ransomware campaigns |
| P1 | "RoguePlanet" (CVE pending) | Microsoft Defender | Critical | Zero-day, patch in development |
| P2 | CVE-2026-20230 | Cisco Unified CM | High | Active scanning/IOC activity observed |
| P2 | CVE-2026-20251 | Splunk Secure Gateway | High | Public PoC released |
| P2 | CVE-2026-41053 | Rancher | 8.8 | Auth bypass, patch available |
1. Adobe ColdFusion & Campaign Classic — APSB26-68 (Released June 30, 2026)
Adobe's bulletin APSB26-68, released June 30, addressed 11 vulnerabilities in ColdFusion (across 2023 and 2025 branches) plus a same-day companion advisory for Campaign Classic, bringing the combined count to 12 CVEs — seven of them rated CVSS 10.0.
Affected versions:
- ColdFusion 2025, Update 9 and earlier
- ColdFusion 2023, Update 20 and earlier
- Campaign Classic v7: 7.4.3 build 9396 and earlier (on-premise only)
Fixed in: ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, Campaign Classic v7.4.3 build 9397
CVE-level breakdown
| CVE | CWE | CVSS 3.1 | Description |
|---|---|---|---|
| CVE-2026-48282 | CWE-22 (Path Traversal) | 10.0 | Unauthenticated directory traversal enabling arbitrary code execution. Actively exploited. |
| CVE-2026-48276 | CWE-434 (Unrestricted Upload) | 10.0 | Unauthenticated malicious file upload → RCE with application privileges |
| CVE-2026-48283 | CWE-434 (Unrestricted Upload) | 10.0 | File-type restriction bypass enabling executable script placement → RCE |
| CVE-2026-48277 | CWE-20 (Improper Input Validation) | 10.0 | Crafted input not sanitized → remote code execution |
| CVE-2026-48281 | CWE-20 (Improper Input Validation) | 10.0 | Inadequate data sanitization → unauthenticated RCE |
| CVE-2026-48316 | CWE-20 (Improper Input Validation) | 10.0 | Flaw in core request-handling logic → unauthenticated RCE |
| CVE-2026-48313 | CWE-22 (Path Traversal) | 9.3 | Arbitrary filesystem read outside intended directory |
| CVE-2026-48315 | CWE-20 (Improper Input Validation) | 9.3 | Privilege escalation via malformed input |
| CVE-2026-48286 (Campaign Classic) | CWE-863 (Incorrect Authorization) | 10.0 | Authorization logic flaw → arbitrary code execution, on-prem only |
The published CVSS 3.1 vector for the flagship flaw, CVE-2026-48282, is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
That string decodes to network-reachable (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), a scope change (S:C — the vulnerable component can impact resources beyond its own security scope), and complete impact to confidentiality, integrity, and availability. This is effectively the textbook combination for a CVSS ceiling score.
Exploitation timeline — CVE-2026-48282
This is the CVE to prioritize above all others this week:
- June 30, 2026 — Adobe publishes APSB26-68; CVE-2026-48282 patched but not flagged as exploited.
- ~July 2, 2026 — A public technical write-up detailing the path-traversal mechanics is published.
- July 2, 2026 (T+~2 hours) — Vulnerability-intelligence tracker KEVIntel records the first confirmed exploitation attempt, originating from an India-geolocated IP address. Attackers used the flaw to drop web shells on unpatched, internet-facing servers.
- July 7, 2026 — CISA adds CVE-2026-48282 to the KEV catalog with a federal remediation deadline of July 10 (already passed by the time of writing).
Why this matters technically: ColdFusion's exploitation history is not incidental — 16 prior CVEs in the product already reside in CISA's KEV catalog, and ColdFusion servers commonly sit between public web front-ends and internal databases, making a successful path-traversal-to-RCE chain here a direct pivot point into backend data stores.
Remediation:
1. Patch to ColdFusion 2025 Update 10 / 2023 Update 21 immediately — treat unpatched
internet-facing instances as an active incident, not a routine patch item.
2. Audit for undocumented/legacy ColdFusion instances across the environment.
3. Hunt for IOCs: unexpected .jsp/.cfm files in web-accessible directories,
unusual outbound connections from the ColdFusion process, and modified
timestamps on files under the webroot.
4. Segment ColdFusion instances off the public internet where the application
does not require direct exposure; front with a WAF rule blocking directory-
traversal sequences (../, encoded variants %2e%2e/) as a compensating control.
5. For Campaign Classic on-prem, verify build 7.4.3.9397 or later.
2. Google Chrome 151 — 382 CVEs Patched (Largest Single Release on Record)
Chrome 151 landed with 382 vulnerabilities remediated — the largest single-version fix count in Chrome's history — spanning V8, WebGL, WebRTC, GPU compositing, autofill, navigation, and the extensions API. Fifteen carry a critical rating enabling remote code execution.
Flagship CVE: CVE-2026-13028
- CWE-416 (Use-After-Free)
- CVSS 3.1: 9.6
- Component: WebGL
- Impact: Remote code execution via improper memory object lifecycle management; on Android, the flaw additionally permits a renderer sandbox escape.
- Attack vector: Requires only that a victim load a specially crafted HTML page — low complexity, no authentication, no elevated privileges needed on the attacker's side.
Fixed versions:
| Platform | Fixed version |
|---|---|
| Windows / macOS | 149.0.7827.197 |
| Linux | 149.0.7827.196 |
| Android | 149.0.7827.197 |
Operational notes: Chrome's silent auto-update will resolve most consumer endpoints within 24 hours, but enterprise fleets managed via Group Policy/ADMX should explicitly verify the UpdatesSuppressed and target-version policies aren't holding installs back. Chromium derivatives (Microsoft Edge, Opera, Brave, Vivaldi) inherit the same underlying engine bugs and require their own separate update verification — do not assume parity with upstream Chrome patch timing.
3. Microsoft Defender — Two Critical Zero-Days Within 48 Hours
Microsoft's built-in, SYSTEM-privileged antivirus was the subject of two independent critical disclosures in rapid succession this week:
CVE-2026-33825 ("BlueHammer")
- Privilege-escalation vulnerability in Microsoft Defender.
- CISA confirmed active exploitation in ransomware campaigns during this window — this is no longer a theoretical risk.
"RoguePlanet" (CVE pending assignment at time of writing)
- Disclosed one day after the BlueHammer ransomware confirmation.
- Microsoft has confirmed the vulnerability exists and is developing a security patch; technical details are being withheld pending release, consistent with responsible-disclosure handling of an unpatched, actively-targetable flaw.
Why the pairing matters: Defender runs with SYSTEM-level privileges and is enabled by default across the Windows install base, making it one of the highest-value single points of compromise on any given host. Two independent critical vulnerabilities in the same trust-boundary component inside a 48-hour window is a materially different risk posture than two unrelated bugs in two different products.
Interim mitigations (pending the RoguePlanet patch):
- Ensure Defender platform and signature updates are current (Windows Update
and MpCmdRun.exe -SignatureUpdate).
- Review Windows Defender operational event logs (Event Viewer →
Applications and Services Logs → Microsoft → Windows → Windows Defender)
for anomalous scan failures, engine crashes, or unexpected process
injections tied to MsMpEng.exe.
- Treat any Defender-related crash or unexpected termination on endpoints as
a potential exploitation indicator given the active BlueHammer campaigns.
- Apply Microsoft's out-of-band patch the moment it is released; do not wait
for the next Patch Tuesday cycle.
4. SimpleHelp RMM — CVE-2026-48558 (CVSS 10.0) — KEV Deadline
CVE-2026-48558 is a CISA KEV-catalogued vulnerability in SimpleHelp remote monitoring and management (RMM) software, tied to confirmed MSP supply-chain compromise activity and deployment of the TaskWeaver loader in post-exploitation stages.
- CVSS: 10.0
- KEV remediation mandate: Binding Operational Directive 26-04's 3-day patching window, with a July 2, 2026 deadline for federal civilian systems.
- Supply-chain angle: Because SimpleHelp is widely deployed by managed service providers to remotely administer client environments, a single compromised MSP instance can cascade into every downstream customer network the MSP has access to — this is the same threat pattern seen in prior RMM-targeted campaigns.
Action items:
1. Confirm patched SimpleHelp version is deployed on every server instance —
not just client agents.
2. If your organization is an MSP customer, request written confirmation of
patch status from your provider; do not assume it's handled.
3. Hunt for TaskWeaver loader IOCs in endpoint telemetry and EDR alerts,
even on systems that have since been patched — patching does not remove
an implant that was already deployed pre-patch.
4. Review SimpleHelp authentication logs for anomalous session activity
predating the patch.
5. Enterprise Infrastructure — Supporting Advisories
| Product | CVE | CWE / Type | CVSS | Detail |
|---|---|---|---|---|
| WinRAR | (RAR5 variant of CVE-2023-40477) | CWE-122 (Heap Buffer Overflow, RAR5 recovery-volume parser) | Not formally scored at disclosure | Fixed in 7.23. The 2023 fix covered only the RAR3 recovery-volume format; RAR5 remained exploitable. No auto-update mechanism exists, so this requires manual or third-party-tooled deployment. |
| Splunk Secure Gateway | CVE-2026-20251 | CWE-502 (Deserialization of Untrusted Data) | High | Public proof-of-concept exploit released, materially raising exploitation likelihood. Patch and restrict Secure Gateway network exposure immediately. |
| Apache Tomcat | (2 CVEs) | Authentication Bypass / Security Constraint Bypass | Not specified | Affects request-routing logic that enforces <security-constraint> rules in web.xml; a bypass can expose internal servlets/endpoints that were assumed protected. |
| Citrix NetScaler ADC/Gateway | (multiple) | Denial of Service / Memory Overflow | High | NetScaler is a network edge device; availability impact here is an operational incident as much as a security one. |
| Rancher | CVE-2026-41053 | CWE-287-class (Incorrect Authentication Caching) | 8.8 | GitHub auth-provider session caching flaw grants access to any logged-in user, regardless of intended RBAC scope — effectively a full authentication bypass for Rancher-managed Kubernetes clusters. Affects 2.13 < 2.13.6 and 2.14 < 2.14.2. |
| Apache ActiveMQ | (6 CVEs) | Input Validation / Authorization / Memory Handling | 7.5–8.1 | Cluster of issues in the message broker; review authorization checks on management/admin endpoints specifically. |
| Cisco Unified CM | CVE-2026-20230 | Not specified in this window's telemetry | High | No KEV addition yet this week, but active scanning traffic was observed. IOC: unexpected files under /platform-services/axis2-web/. |
Cisco Unified CM — hunting guidance:
1. Scan the filesystem on all Unified CM nodes for new/unexpected files
under /platform-services/axis2-web/ — this is the confirmed IOC path
for scanning/exploitation activity tied to CVE-2026-20230.
2. Update WAF/firewall rules to block or alert on inbound traffic from
known Tor exit nodes to public-facing Unified CM instances — observed
scanning traffic has been sourced from Tor infrastructure.
3. Network-segment Unified CM and other voice/UC infrastructure away from
general user and server VLANs; do not allow direct inbound access from
the general corporate network beyond what call-control functionality
strictly requires.
Consolidated Patch-Order Recommendation
Ranked by exploitation status and blast radius, not just CVSS score alone:
- CVE-2026-48282 (ColdFusion) — confirmed active exploitation, KEV-bound, RCE, no auth required. Patch or take offline now.
- CVE-2026-48558 (SimpleHelp) — KEV deadline already passed; supply-chain blast radius across MSP customer bases.
- CVE-2026-33825 "BlueHammer" (Defender) — confirmed active ransomware use.
- Remaining ColdFusion CVSS 10.0 cluster (48276/48277/48281/48283/48316) and Campaign Classic CVE-2026-48286 — not yet observed exploited, but same product family as an already-weaponized bug; assume attacker interest is high.
- Chrome 151 / CVE-2026-13028 — verify fleet-wide deployment; sandbox-escape potential on Android raises this above routine browser patching.
- Rancher CVE-2026-41053 — full auth bypass on Kubernetes management plane; prioritize for any cluster exposed beyond a tightly trusted network.
- Splunk CVE-2026-20251 — public PoC now available; assume weaponization is imminent.
- Cisco Unified CM CVE-2026-20230 — hunt for IOCs now even before a full patch cycle completes.
- Tomcat / NetScaler / ActiveMQ / WinRAR — apply in normal patch cadence, but don't let WinRAR's lack of auto-update become a permanent gap; it has historically been the long-tail item attackers return to.
Closing Analysis
The technical throughline this week is the concentration of unauthenticated, no-user-interaction RCE across products that are either internet-facing by design (ColdFusion, NetScaler, Unified CM) or run with elevated system privileges by default (Defender). Seven CVSS 10.0 scores in a single week is a statistical outlier even against 2026's already-elevated baseline, and the roughly two-hour gap between technical disclosure and first observed exploitation of CVE-2026-48282 reinforces a pattern seen repeatedly this year: public technical write-ups are now functioning as a starting gun for opportunistic scanning, not merely academic reference material. Vulnerability management programs should weight time-to-patch at least as heavily as CVSS score when triaging this batch.
This brief was compiled from Adobe Security Bulletin APSB26-68, CISA KEV catalog entries, Google Chrome Releases, Microsoft Security Response Center advisories, and independent vulnerability-intelligence reporting current as of July 5, 2026. Stay tuned to CybersLion for the follow-up covering Microsoft's July 14 Patch Tuesday, which broke its own record with 622 CVEs addressed in a single release.