Internet-facing enterprise and admin software crossed into confirmed exploitation again this week — ServiceNow, SharePoint, Check Point management, Langflow and WordPress core all moved to under-attack, and several leave persistence the patch does not remove
If you did nothing this week: every internet-facing ServiceNow AI Platform, on-prem SharePoint Server, internet-exposed Check Point management server, self-hosted Langflow instance and unpatched WordPress core site in your estate is now sitting behind at least one confirmed, in-the-wild-exploited vulnerability — and for the SharePoint, Check Point and WordPress cases, an attacker who reached it before you patched still holds keys, tokens or accounts that the update does not revoke.
The week's pattern was less a single product than a category repeatedly crossing from disclosed to exploited. NCSC-CH updated its advisory to mark the ServiceNow AI Platform pre-authentication sandbox escape CVE-2026-6875 as "Actively exploited" (NCSC-CH, 2026-07-20); in-the-wild activity was reported from 2026-07-18, and with ServiceNow's hosted instances already patched the residual exposure is self-hosted and partner-managed deployments that have not applied hotfix KB3137947 (BleepingComputer, 2026-07-20). On-prem SharePoint Server was next: NCSC-NL reported that a public exploit for the pre-auth deserialization RCE CVE-2026-50522 had been published and that on-premise versions were now being actively abused (NCSC-NL, 2026-07-21); watchTowr's honeypots "captured exploitation attempts using this PoC that successfully compromised target systems" within hours of its release, and documented that attackers steal ASP.NET machine keys for persistent, forged authentication that survives patching (BleepingComputer relaying watchTowr, 2026-07-21).
The Check Point management surface ran the same play against defenders' own infrastructure: Check Point confirmed active exploitation of the SmartConsole authentication bypass CVE-2026-16232 against "a handful of customers" whose management server was exposed directly to the internet without IP restrictions (Check Point, 2026-07-22), CISA added it to KEV the same day (CISA, 2026-07-22), and days later NCSC-NL (NCSC-NL, 2026-07-24) and CERT-FR (CERT-FR, 2026-07-23) flagged two siblings shipped in the same bundle — a CVSS-10.0 (NCSC-NL CVSS v4) unauthenticated command-execution flaw (CVE-2026-62144) on the exact management surface already under attack, and a Gaia Portal read-only-to-root escalation (CVE-2026-62145). Self-hosted Langflow — increasingly deployed by EU/CH public-sector and research bodies building internal LLM/agent pipelines — saw CISA KEV-list the unauthenticated exec_globals code-execution flaw CVE-2026-0770 on 2026-07-21 (CISA, 2026-07-21), the same day a 15-CVE batch (including an unauthenticated account-creation path to code execution) was disclosed. And WordPress core closed the set: the "WP2Shell" pre-auth chain (route confusion in the unauthenticated REST batch endpoint, CVE-2026-63030, chained with the SQL injection CVE-2026-60137) went from "no confirmed exploitation" at first coverage to confirmed in-the-wild abuse and CISA KEV on 2026-07-21, with Rapid7 stating that "given confirmed exploitation in the wild" operators should investigate for signs of compromise (Rapid7, 2026-07-22).
Current exploitation status: Actively exploited
Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.
This only affects a very specific configuration — when Management is exposed directly to the internet without IP restrictions.
Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059.006Command and Scripting Interpreter: Python
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
Persistence TA0003
T1136Create Account
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Credential Access TA0006
T1552.004Unsecured Credentials: Private Keys
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
T1606Forge Web Credentials
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.