2026-W31 vulnerability status roll-up — twelve CVEs stood at confirmed exploitation, three carry public exploit chains, and a dense critical tail hit management planes, OT, ERP and the AI toolchain
Confirmed exploited or newly KEV-listed this week. Five items crossed into confirmed exploitation for the first time. Arista's on-prem VeloCloud Orchestrator flaw CVE-2026-16812 arrived already exploited — "this issue was discovered externally and is known to be actively exploited" (Arista Networks, 2026-07-27) — and was KEV-listed the same day alongside FortiOS CVE-2025-68686 (CISA, 2026-07-27). Cisco Secure FMC CVE-2026-20316 followed two days later, with Cisco stating that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" (Cisco PSIRT, 2026-07-29). The Balbooa Gridbox pair CVE-2026-65884 and CVE-2026-65885 are the week's only items with server-log-level exploitation evidence: "we have the server access logs showing the exploitation requests arriving, and connected sites where the accounts are already planted. On one connected Joomla site our rogue admin check is holding 92 planted accounts right now" (mySites.guru, 2026-07-29). And fastjson CVE-2026-16723 is exploited with no patch that can ever arrive on the 1.x line.
Already-exploited items whose status moved. Five CVEs the store already carried as exploited changed in ways that alter defender work rather than merely accumulating coverage. CVE-2026-16232 (Check Point Security Management) gained a published root cause and a confirmed default-configuration precondition. CVE-2026-12569 (PTC Windchill / FlexPLM) moved from exploitation into a mass extortion-email phase, with the significant detail that "as of 22 July, Cl0p ransomware has not begun listing victims of this latest campaign on their dark web data leak site or has publicly claimed credit for this latest campaign" (Ransom-ISAC, 2026-07-22) — placing affected organisations between exfiltration and publication. CVE-2026-42897 (Exchange OWA), KEV-listed back in May, gained a state-actor attribution and a named browser-resident implant. CVE-2013-4786 moved from a known design weakness to documented in-the-wild abuse of server management planes. And CVE-2026-39987 (marimo) was corrected upward: this pipeline's own 2026-08-02 correction records Unit 42 confirming command execution on 11 notebook endpoints, not merely attempted, which the earlier entry had omitted.
Public exploit chain or full mechanics, no confirmed in-the-wild abuse. Three items are a disclosure away from exploitation rather than a discovery away. CVE-2026-61511 (vBulletin) had working exploit code published four weeks after the patch. CVE-2026-66066 (Rails Active Storage) lost its embargo four weeks early because researchers reconstructed the chain independently, and Rails shipped forensic tooling in the same move. CVE-2026-59726 (Ruflo, CVSS 10.0) had the single unauthenticated request that reaches code execution published with the advisory, and its poisoned agent-memory effect survives a patched redeploy.
Exploited but absent from KEV. CVE-2026-0769 (Langflow) sits in a category of its own this week and is the reason a KEV-only process was insufficient: VulnCheck reports observed exploitation and states plainly that "neither of these vulnerabilities have been added to CISA KEV" (VulnCheck, 2026-07-28), while ZDI documents no fixed version at all.
Critical-but-unexploited tail requiring scheduled action. JetBrains TeamCity On-Premises CVE-2026-63077 (CVSS 9.8, every on-prem version ever shipped). VMware VMSA-2026-0006 — CVE-2026-59309 and CVE-2026-59310 both CVSS 9.8 and pre-authentication against vCenter, plus the VMXNET3 guest-to-host escape CVE-2026-47876, with no workaround for any of the five. Apache Airflow's FAB provider CVE-2026-59243, where no party has published a CVSS. Siemens Desigo CC CVE-2025-15467 with the V7 family unfixable, alongside Mendix Runtime CVE-2026-7891. IBM WebSphere CVE-2026-14512, CVE-2026-14446 and CVE-2026-14528, on interim APARs until fix packs targeted for 3Q2026. SolarWinds Web Help Desk CVE-2026-28323 and CVE-2026-28299. Adobe Campaign Classic CVE-2026-48449 (CVSS 10.0 unauthenticated code execution) and CVE-2026-48448, affecting on-premise and hybrid deployments only. Phoenix Contact CHARX SEC-3xxx, twenty CVEs with firmware 1.9.1 unreleased at disclosure. The Joomla extension batch CVE-2026-65883, CVE-2026-65766, CVE-2026-65879, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65876. HashiCorp terraform-mcp-server CVE-2026-14869, CVE-2026-16496 and CVE-2026-16498. And nine JFrog Artifactory Self-Managed CVEs whose chained critical scenario depends on Anonymous Access being enabled.
This issue was discovered externally and is known to be actively exploited.
In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
With LangFlow, we've seen attackers gain initial access using exploits targeting both CVE-2026-0769 and CVE-2026-5027, harvest credentials, likely for services such as OpenAI and Claude, deploy cryptominers, and attempt lateral movement. Neither of these vulnerabilities have been added to CISA KEV.
We have the server access logs showing the exploitation requests arriving, and connected sites where the accounts are already planted. On one connected Joomla site our rogue admin check is holding 92 planted accounts right now
ATT&CK mapping
8 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1136.001Create Account: Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
T1542.001Pre-OS Boot: System Firmware
Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Stealth TA0005
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1211Exploitation for Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
T1542.001Pre-OS Boot: System Firmware
Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.
Credential Access TA0006
T1606Forge Web Credentials
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.