Looking ahead — 2026-W27

Items already in motion — sourced developments a defender should expect to act on in the coming weeks, not forecasts:

• Adobe ColdFusion — six CVSS 10.0 unauth RCEs awaiting weaponisation. APSB26-68 fixed six maximum-severity RCE paths (file-upload, input-validation, path-traversal), all Adobe Priority 1, with no known exploitation yet (Adobe PSIRT, 2026-06-30). ColdFusion's history is rapid weaponisation of unauth file-upload primitives — patch internet-facing instances before a PoC lands (§ references).
• Citrix NetScaler CVE-2026-8451 — public test artefact, siblings exploited within days. A "Detection Artefact Generator" is public and CitrixBleed-lineage siblings have been exploited within days of disclosure; treat exploitation as a matter of time (§ references).
• WatchGuard Firebox 12.5.x — fix still pending. The pre-auth iked RCE (CVE-2026-13368) has no fix for the 12.5.x branch and 11.x is EOL; a build is expected — until it ships, the LDAP-backed IKEv2 path must be removed, not waited on (WatchGuard PSIRT, 2026-07-02).
• Dutch NIS2 — Senate vote 7 July, entry into force 15 August 2026. The Eerste Kamer floor vote is scheduled for 7 July with a revised entry-into-force target of 15 August (Eerste Kamer, bill 36764); organisations with Dutch nexus should re-anchor readiness milestones (this week's policy entry).
• ShinyHunters Oracle PeopleSoft — un-notified victim tail. GTIG's ~100-organisation notification set is still landing (68% higher education); more European education and public-finance named victims are likely (this week's long-running status; § references).
• FortiBleed-actor Nextcloud zero-day — pending vendor disclosure. SOCRadar states the INC/Lynx-linked FortiBleed operator holds an undisclosed Nextcloud zero-day, coordination in progress. Single-source and unconfirmed — but given Nextcloud's Swiss/German public-sector prevalence, be ready to prioritise a patch the moment Nextcloud publishes (this week's FortiBleed status entry).