🛡️ Cybersecurity Vulnerability Watch

Week of: 2026-07-19 to 2026-07-25 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

---

1. Top Action Item

Patch or mitigate the actively exploited unauthenticated RCE in Alibaba's Fastjson 1.x library (CVE-2026-16723, CVSS 9.0) if you run Java/Spring Boot applications that process JSON. No vendor patch exists; apply workarounds from security vendors (ThreatBook, Imperva) such as upgrading to Fastjson 2.x or implementing strict JSON input validation. Also prioritize applying the GitLab 18.11.3 update from June 10 to prevent unauthenticated RCE via Jupyter notebook payloads, now that public exploit code is circulating.

---

2. Exploited This Week

Fastjson 1.x — CVE-2026-16723 (Critical, CVSS 9.0)

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (9.0)
• What's happening: Attackers are targeting a critical remote code execution flaw in Alibaba's Fastjson JSON library, exploiting Spring Boot applications without authentication to execute commands as the Java process.
• Fix: No patched version of Fastjson 1.x is available; upgrade to Fastjson 2.x or implement input validation/monitoring as recommended by ThreatBook and Imperva.

PTC Windchill / FlexPLM (unauthenticated RCE, no CVE given)

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (see source)
• What's happening: Cl0p (FIN11/Lace Tempest) affiliates are chaining a pre-authentication information disclosure with an unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM deployments to perform data extortion.
• Fix: Apply vendor patches for Windchill and FlexPLM; close internet exposure of these systems if possible.

Zimbra Webmail (zero-day, no CVE given)

• Source: Dark Reading / Palo Alto Unit 42
• Link: Dark Reading / Unit 42
• Severity: High (see source)
• What's happening: Russian state-sponsored group "Laundry Bear" is exploiting a zero-day in Zimbra webmail to steal credentials via JavaScript injection; a "half-click" phishing email triggers exploitation on message preview.
• Fix: Apply Zimbra security updates; no specific patch version provided in reports—check Zimbra's advisory.

---

3. Critical Patch Roundup

GitLab CE/EE (RCE)

• Source: The Hacker News
• Link: The Hacker News
• Severity: High (see source)
• What's happening: Working exploit code published for a GitLab RCE that was patched June 10 (v18.11.3). Any authenticated user who can push to a project can execute commands as the git user on unpatched self-managed servers.
• Fix: Upgrade to GitLab 18.11.3 or later.

Chromium Browser Engines (CVEs: CVE-2026-16807, CVE-2026-16806, CVE-2026-16805, CVE-2026-16804)

• Source: Microsoft MSRC
• Link: MSRC (representative)
• Severity: High (see source)
• What's happening: Multiple Chromium vulnerabilities (out-of-bounds write, use-after-free in Codecs, WebMCP, Blink, Input) addressed by Google and ingested by Microsoft Edge and other Chromium-based browsers.
• Fix: Update Chrome/Edge to the latest stable version (see Google Chrome Releases).

OpenAI ChatGPT Workspace Agents — AgentForger

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (see source)
• What's happening: A single phishing link could stealthily deploy a rogue AI agent inside an organization via OpenAI's ChatGPT Workspace Agents; fixed as of June 8, 2026.
• Fix: Ensure workspace agents are updated to the latest version (no action needed if using OpenAI cloud with auto-updates).

Microsoft Bing Images (CVEs: CVE-2026-32194, CVE-2026-???)

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (see source)
• What's happening: Crafted SVG submitted to Bing image search could execute code as SYSTEM or root on Microsoft's image-processing workers; two critical CVEs issued.
• Fix: Microsoft has patched its server-side image tier; no user action required.

Active Directory — Certighost (certificate impersonation)

• Source: The Hacker News
• Link: The Hacker News
• Severity: High (see source)
• What's happening: Public exploit code lets a low-privileged AD user obtain a certificate for a Domain Controller account, enabling DCSync and full domain compromise.
• Fix: No patch announced; monitor for anomalous certificate enrollment (especially for domain controller templates) and apply AD certificate hardening.

Azure Automation — cross-tenant identity takeover

• Source: Dark Reading
• Link: Dark Reading
• Severity: High (see source)
• What's happening: A default public-by-configuration in Azure Automation combined with code flaws could allow attackers to seize another tenant's identity and access workloads. Microsoft has addressed the issue.
• Fix: Review and restrict Azure Automation public access settings; apply any Azure-side fixes.

Azure AI Search — CVE-2026-56167 (SSRF -> EoP)

• Source: Microsoft MSRC
• Link: MSRC
• Severity: High (see source)
• What's happening: Server-side request forgery in Azure AI Search allows an authorized attacker to elevate privileges.
• Fix: Apply the Azure service update (automatic for managed services; no user action except ensuring feature is updated).

Azure Kubernetes Service — CVE-2026-56163 (EoP)

• Source: Microsoft MSRC
• Link: MSRC
• Severity: High (see source)
• What's happening: Missing authentication for critical function in AKS allows an unauthorized attacker to elevate privileges over the network.
• Fix: Apply the AKS update; review RBAC configurations.

Microsoft Account RCE — CVE-2026-56165

• Source: Microsoft MSRC
• Link: MSRC
• Severity: Critical (see source)
• What's happening: Heap-based buffer overflow in Microsoft Account allows unauthenticated remote code execution over the network.
• Fix: Apply the Microsoft Account service update (automatic in cloud; no user action needed).

---

4. Home / SOHO Impact

• Update your browser: Update Google Chrome or Microsoft Edge to the latest version to fix four critical Chromium vulnerabilities that could let attackers run code on your device.
• If you run a Zimbra email server at home (rare but possible), check for vendor patches for the exploited zero-day; restrict admin access.
• If you use Java apps or Spring Boot that handle JSON, review if you have Fastjson 1.x and follow community workarounds (no official patch yet).
• No other immediate home user actions from this week's alerts—most items target enterprise infrastructure.

---

5. Enterprise Impact

• Fastjson 1.x (CVE-2026-16723) — Patch urgently. If you have Spring Boot or any app using Fastjson 1.x, implement the recommended workarounds (migrate to 2.x, input validation) immediately as active exploitation is confirmed.
• GitLab RCE — Patch to 18.11.3 now that public exploit code exists. This is a high-priority for all self-managed instances.
• Cl0p targeting PTC Windchill/FlexPLM — Block internet exposure and apply vendor patches. These are common in manufacturing and product lifecycle management environments.
• Zimbra zero-day — Apply updates immediately if you run Zimbra; monitor for signs of credential theft or JS injection. Russian threat actors are actively targeting US/Ukraine organizations.
• Certighost exploit (Active Directory) — No patch yet, but you should audit certificate enrollment permissions, monitor for unusual domain controller certificate requests, and consider deploying ADCS monitoring rules.
• Azure services — Review your Azure Automation public access configuration, and ensure your AKS and AI Search instances are on the latest service versions. Microsoft has addressed these server-side, but verify.
• OpenAI ChatGPT Workspace Agents — Ensure agents are updated (auto-update should be fine); review agent permissions if you have custom agents.

---

6. What To Patch First

1. Fastjson 1.x — CVE-2026-16723 (exploited in the wild, critical, no patch — apply workarounds)
2. PTC Windchill / FlexPLM (exploited in the wild, critical — apply vendor patch)
3. Zimbra Webmail (exploited in the wild — apply vendor patch)
4. GitLab CE/EE — v18.11.3 (PoC published, widely deployed enterprise software)
5. Google Chrome / Microsoft Edge — latest version (critical Chromium CVEs, widely deployed)
6. Azure AI Search — CVE-2026-56167 (critical, cloud service)
7. Azure Kubernetes Service — CVE-2026-56163 (critical, cloud service)
8. Active Directory certificate services — monitor for Certighost (no patch, but urgent detection)

---

Sources

• Fastjson RCE targeted in attacks — https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html
• Cl0p targeting PTC Windchill/FlexPLM — https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
• Zimbra zero-day — https://www.darkreading.com/cyberattacks-data-breaches/russian-hackers-zimbra-zero-day-us-ukraine-targets
• Russian webmail espionage (Unit 42) — https://unit42.paloaltonetworks.com/russian-webmail-espionage/
• GitLab RCE PoC — https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html
• Chromium CVEs (CVE-2026-16807 et al.) — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-16807
• Bing Images critical CVEs — https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html
• ChatGPT AgentForger — https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html
• Certighost exploit — https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
• Azure Automation cross-tenant takeover — https://www.darkreading.com/cloud-security/default-azure-automation-setting-cross-tenant-identity-takeover
• Azure AI Search CVE-2026-56167 — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56167
• Azure Kubernetes Service CVE-2026-56163 — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56163
• Microsoft Account RCE CVE-2026-56165 — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165