2026-W30 looking ahead — items already in motion: a nginx pre-auth RCE PoC on a ~21-day release clock, Oracle Fusion Middleware abuse assessed 'very likely', a public AD CS DCSync PoC, a Mitel CVE pending, and two EU compliance clocks tightening

A justified watch list of items already in motion at the close of 2026-W30 — each a concrete, sourced development, none a prediction.

Exploitation clocks running. The nginx / NGINX Plus pre-auth heap-overflow CVE-2026-42533 has a working pre-auth RCE that the credited discoverer demonstrated defeats ASLR in a single request, with the exploit proof-of-concept deliberately withheld for roughly 21 days from its mid-July disclosure (cyberstan.co.uk, 2026-07-19) — so anyone running internet-facing nginx should complete the F5 out-of-band patch before that window closes in early August. Oracle's July Critical Patch Update carries nine unauthenticated CVSS-10.0 flaws in Fusion Middleware, and NCSC-NL assesses that large-scale abuse in the short term is very likely (NCSC-NL, 2026-07-22) — internet-reachable Fusion Middleware is the exposure to close now. The Windows AD CS "Certighost" flaw CVE-2026-54121, patched by Microsoft in July (Microsoft MSRC, 2026-07-14), now has a full public PoC letting a low-privileged domain user forge a Domain Controller certificate and DCSync the krbtgt hash (CybersecurityNews, 2026-07-24) — treat any AD CS estate that has not applied the July cumulative update as weaponizable now. And Mitel's unauthenticated MiCollab AWV command-injection flaw (CVSS 9.8) still carries only an internal id, MTLVULN-1694, with no assigned CVE (Mitel PSIRT, 2026-07-22), so exposure tracking cannot yet rely on a CVE identifier.

Compliance clocks tightening. Two EU dates established and sourced in prior weeklies are now close enough to act on: the Dutch NIS2 transposition, the Cyberbeveiligingswet, enters into force on 15 August 2026 (about three weeks out), and the CRA Article 14 obligation — a 24-hour early warning to a CSIRT/ENISA on awareness of an actively-exploited vulnerability, a 72-hour notification and a 14-day final report — begins on 11 September 2026. Freshly anchoring that September window, ENISA's public consultation on the mandatory EU Managed Security Services certification scheme closes on 13 September 2026 (ENISA, 2026-07-24), two days after the CRA clock starts. For Swiss and European organisations with Dutch entities, EU-market product suppliers, or MSSP relationships touching the EU Cybersecurity Reserve, these are calendar items to fold into August-September planning now.