ThreatScope

Monthly Cybersecurity Report 

July 2026

Reporting Period: July 1 – July 31, 2026

Threat Level: Critical

🎧 Listen to July’s ThreatScope (audio brief)

Executive Summary

July was characterised by continued exploitation of internet-facing enterprise platforms, identity infrastructure and centralized security management systems. Throughout the month, attackers consistently targeted technologies that provide administrative visibility, privileged access or direct connectivity to internal business environments.

Several vulnerabilities affecting Microsoft SharePoint, Cisco Secure Firewall Management Center, VMware vCenter, Fortinet FortiOS, Active Directory Federation Services (AD FS), Check Point SmartConsole and Arista VeloCloud moved quickly from disclosure to active exploitation. Multiple vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, reinforcing the importance of prioritising confirmed exploitation rather than relying solely on CVSS scores.

Another notable trend was the continued focus on software supply chain security. Critical vulnerabilities affecting Ruby on Rails, Node.js, Bouncy Castle and other widely deployed software components demonstrated that application dependencies remain attractive targets capable of affecting multiple organisations simultaneously.

Industrial Control Systems (ICS) and Operational Technology (OT) environments also received significant attention during July, with CISA publishing numerous advisories affecting manufacturing, energy and critical infrastructure sectors. While immediate patching is not always operationally feasible in these environments, organisations should continue strengthening segmentation, monitoring and recovery capabilities.

The overall picture remains consistent with previous months. Attackers continue prioritising technologies that enable broad administrative access, persistence and lateral movement rather than isolated endpoint compromise.

This Month at a Glance

Key Threat Trends

Identity Infrastructure Remained a Primary Target

Identity services continued to receive significant attention throughout July. Vulnerabilities affecting Microsoft Active Directory Federation Services (AD FS), Active Directory Certificate Services and Microsoft SharePoint reinforced a broader trend observed throughout the year. Systems responsible for authentication, certificate management and privileged access remain among the highest-value targets because successful compromise may enable attackers to move throughout the environment while maintaining trusted identities.

Security Management Platforms Continue to Be Targeted

Several of the month’s highest-priority vulnerabilities affected centralized security management platforms, including Cisco Secure Firewall Management Center, Check Point SmartConsole and Arista VeloCloud Orchestrator.

Rather than targeting individual endpoints, attackers increasingly focus on platforms capable of managing security policies, firewall configurations or network connectivity across the organisation. Compromise of these systems can provide operational visibility well beyond a single server or workstation.

Internet-Facing Applications Remain the Initial Entry Point

Microsoft SharePoint, Fortinet SSL-VPN, Ruby on Rails applications and WordPress environments continued to appear in active exploitation and public security advisories.

Public exposure remains one of the strongest indicators of operational risk. Organisations should continuously review internet-facing assets, validate software versions and confirm that emergency security updates have been successfully deployed.

Software Supply Chain Risks Continue to Grow

July also highlighted the growing importance of software dependency management.

Critical updates affecting Ruby on Rails, Node.js and Bouncy Castle demonstrated that vulnerabilities introduced through third-party libraries may affect thousands of applications simultaneously. Maintaining accurate software inventories and Software Bill of Materials (SBOM) records continues to be an essential security practice.

Industrial Control Systems Require Operationally Balanced Security

Multiple CISA advisories affecting industrial technologies confirmed that operational technology remains an important focus for defenders.

Because production environments frequently require planned maintenance windows before security updates can be applied, organisations should combine vulnerability management with network segmentation, monitoring and tested recovery procedures.

Key Vulnerabilities

Industry Exposure

Although the vulnerabilities disclosed during July affected a broad range of technologies, certain sectors face consistently higher operational risk because of the platforms they commonly deploy and the regulatory environments in which they operate.

Organisations operating across multiple sectors should evaluate exposure against their complete technology inventory rather than individual systems. Centralised management platforms and identity services frequently support multiple business functions and therefore require higher remediation priority.

Operational Priorities

Immediate Actions (0–7 Days)

Organisations should prioritise vulnerabilities with confirmed active exploitation or inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog.

Recommended actions include:

• Apply emergency security updates for internet-facing systems.
• Prioritise remediation of Microsoft SharePoint, Cisco FMC, Fortinet and VMware environments.
• Verify that management interfaces are not publicly accessible.
• Review authentication logs and privileged administrative activity.
• Perform compromise assessments where active exploitation has been confirmed.
• Validate backup integrity before implementing significant infrastructure updates.

Actions Within 30 Days

Once the highest-priority vulnerabilities have been addressed, organisations should strengthen their overall security posture.

Recommended activities include:

• Review software dependencies across internally developed applications.
• Update vulnerable third-party libraries such as Node.js and Bouncy Castle.
• Rotate credentials, certificates and application secrets where compromise cannot be excluded.
• Review network segmentation protecting management platforms.
• Validate asset inventories against current vulnerability exposure.

Strategic Priorities (Within 90 Days)

Long-term resilience requires more than routine patch management.

Organisations should continue to:

• strengthen Attack Surface Management capabilities;
• improve software dependency governance and Software Bill of Materials (SBOM) visibility;
• expand monitoring of administrative infrastructure through SIEM and SOC operations;
• regularly test disaster recovery and business continuity procedures;
• integrate threat intelligence into enterprise risk management and remediation planning.

Executive Questions

Executive leadership and security teams should consider the following questions when reviewing this month’s findings.

• Do we operate any technologies that experienced confirmed active exploitation during July?
• Which administrative platforms remain accessible from the internet?
• Have emergency security updates been independently verified after deployment?
• Have compromise assessments been completed for actively exploited systems?
• Are privileged management platforms sufficiently isolated from standard user networks?
• Do we maintain an accurate inventory of third-party software dependencies?
• Can we recover critical infrastructure within acceptable business timeframes?
• Are accepted security risks formally documented and periodically reviewed?

These questions support a risk-based approach to vulnerability management rather than focusing solely on technical severity scores.

What This Means for Organizations

Several important observations emerged during July.

First, organisations should expect continued targeting of identity infrastructure and centralised management platforms. These technologies provide attackers with broad operational visibility and often represent the fastest path toward privilege escalation and lateral movement.

Second, active exploitation continues to develop rapidly following public disclosure. Emergency patching should therefore be accompanied by compromise assessment, log analysis and verification that remediation has been completed successfully.

Third, software supply chain security remains a growing operational challenge. Dependencies introduced through modern development frameworks may expose organisations even when internally developed code has not changed.

Finally, operational resilience increasingly depends on preparation rather than reaction. Asset visibility, tested recovery procedures, continuous monitoring and structured vulnerability management remain among the most effective defensive capabilities available to enterprise organisations.

Monthly Risk Outlook

Based on the vulnerabilities, advisories and attack activity observed throughout July, several priorities are likely to remain relevant during the coming weeks:

• Continued exploitation of internet-facing enterprise platforms.
• Ongoing attacks targeting identity and authentication infrastructure.
• Increased focus on centralised management systems.
• Continued publication of vulnerabilities affecting software supply chains.
• Persistent pressure on operational technology and industrial control environments.

Organisations should expect attackers to continue combining publicly available exploits with misconfigurations and exposed administrative interfaces rather than relying exclusively on newly discovered zero-day vulnerabilities.

Conclusion

July 2026 reinforced several trends that have been developing throughout the year.

Attackers continue to prioritise technologies that provide centralised administration, identity management and broad visibility across enterprise environments. Rather than focusing exclusively on end-user devices, threat actors increasingly target systems capable of supporting privilege escalation, persistence and lateral movement across multiple business services.

The month also demonstrated that vulnerability prioritisation cannot rely solely on technical severity scores. Several of July’s highest-priority vulnerabilities were classified as actively exploited shortly after disclosure and were subsequently added to the CISA Known Exploited Vulnerabilities (KEV) Catalog. In these cases, active exploitation, internet exposure and the operational role of the affected technology had a greater impact on organisational risk than the published CVSS score.

Another important observation was the continued growth of software supply chain risk. Security updates affecting Ruby on Rails, Node.js, Bouncy Castle and other widely deployed components highlighted the importance of maintaining accurate software inventories, reviewing third-party dependencies and validating the security of internally developed applications.

Industrial Control Systems (ICS) and Operational Technology (OT) environments remained under increased scrutiny throughout the month. Organisations operating critical infrastructure should continue balancing operational continuity with effective vulnerability management through planned maintenance windows, network segmentation and continuous monitoring.

Ultimately, reducing cyber risk requires more than timely patch deployment. Organisations should verify that remediation has been successfully completed, assess whether compromise occurred before updates were applied and continuously review exposed administrative systems, identity infrastructure and internet-facing assets.

ISO 27001 Alignment

The priorities identified throughout July support several control domains within an Information Security Management System (ISMS) aligned with ISO/IEC 27001, including:

• Asset Management
• Vulnerability Management
• Secure Configuration Management
• Access Control
• Identity and Authentication Management
• Logging and Monitoring
• Incident Detection and Response
• Network Security
• Cryptographic Controls
• Supplier and Third-Party Risk Management
• Backup and Recovery
• Business Continuity
• Risk Assessment and Risk Treatment

Organisations should maintain evidence that security updates have been successfully deployed, remediation activities have been validated and any accepted risks are formally documented.

ISO 9001 Alignment

The recommendations presented throughout this review also support quality management practices defined by ISO 9001, including:

• Risk-based decision-making
• Controlled change management
• Documented operational processes
• Corrective and preventive actions
• Continual improvement
• Management review of operational performance
• Evidence-based decision-making

Integrating cybersecurity activities into established quality management processes helps improve consistency, accountability and long-term operational resilience.

Need Help Assessing Your Exposure?

Identifying an affected technology is only the beginning.

Organisations should also determine:

• whether vulnerable systems are present within their environment;
• whether those systems were exposed before remediation;
• whether indicators of compromise exist;
• whether emergency updates were successfully applied;
• whether recovery procedures have been validated;
• whether critical management platforms and identity infrastructure remain adequately protected.

DIAMATIX helps organisations strengthen operational resilience through expert-led:

• Security Operations Center as a Service (SOCaaS)
• Managed Detection and Response as a Service (MDRaaS)
• Incident Response
• Vulnerability Management
• Digital Forensics
• Virtual Chief Information Security Officer (vCISO)

Our objective is to help organisations move beyond reactive patching toward continuous visibility, validation and operational resilience.

Contact DIAMATIX

Sources

This review is based on publicly available information published throughout July 2026, including:

• Monthly ThreatScope report
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• Microsoft Security Response Center (MSRC)
• Cisco Security Advisories
• Broadcom Security Advisories
• Fortinet PSIRT
• Check Point Security Advisories
• Oracle Critical Patch Update
• Ruby on Rails Security Advisories
• Node.js Security Releases
• National Vulnerability Database (NVD)
• CISA Industrial Control Systems (ICS) Advisories
• ENISA
• CERT-EU
• Shadowserver Foundation
• VulnCheck
• The Hacker News
• BleepingComputer
• Publicly available technical research published during the reporting period

Methodology

ThreatScope by DIAMATIX provides a monthly operational review of vulnerabilities, threat activity and security developments that have the greatest potential impact on enterprise environments.

Unlike a comprehensive vulnerability database, ThreatScope focuses on issues that are most likely to influence operational decision-making.

Each vulnerability or campaign is evaluated using multiple criteria, including:

• confirmed active exploitation;
• inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog;
• availability of public proof-of-concept code;
• internet exposure;
• operational importance of the affected technology;
• potential business impact;
• likelihood of privilege escalation, persistence or lateral movement.

The objective of ThreatScope is to help organisations prioritise remediation based on operational risk rather than technical severity alone and to support informed decision-making by executive leadership, security teams and IT operations.

Trusted · Innovative · Vigilant