ThreatScope by DIAMATIX

VeloCloud, SharePoint, Check Point and AI Infrastructure Risks (July 22–28, 2026)

Reporting period: July 22–28, 2026
Threat level: Critical

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

This week’s ThreatScope covers newly added vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) Catalog together with active campaigns affecting enterprise collaboration platforms, security management infrastructure, AI application frameworks and identity services.

The highest priority this week is the active exploitation of Arista VeloCloud Orchestrator, Microsoft SharePoint Server, Check Point SmartConsole and Fortinet FortiOS SSL-VPN. The reporting period also highlights growing risks affecting AI infrastructure through Langflow, identity compromise opportunities involving Microsoft Active Directory Certificate Services and state-sponsored activity targeting Zimbra Collaboration Suite.

Operational priority should not be determined by CVSS scores alone. Active exploitation, internet exposure, the role of the affected platform and its impact on business operations should determine the order of response.

Patching remains essential, but organizations should also verify whether affected systems have already been compromised, review indicators of persistence and confirm that remediation has been completed successfully.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organization operates any of the following technologies or environments.

If none of these technologies are present in your environment, immediate emergency remediation may not be required. However, organizations should still review this week’s campaigns because several techniques target identity infrastructure, AI platforms and publicly accessible enterprise applications that may become increasingly common across different sectors.

Executive Summary

CISA added multiple vulnerabilities with confirmed real-world exploitation to the Known Exploited Vulnerabilities Catalog during the reporting period.

The highest immediate risks come from:

• unauthenticated command injection affecting Arista VeloCloud Orchestrator;
• authentication bypass in Check Point SmartConsole;
• remote code execution affecting Microsoft SharePoint Server;
• active exploitation of Fortinet FortiOS SSL-VPN;
• remote code execution in Langflow AI infrastructure.

The SharePoint vulnerability requires more than routine patching. Public reporting indicates that attackers continue extracting ASP.NET machine keys after exploitation, making compromise assessment and post-remediation validation essential.

The VeloCloud vulnerability affects the centralized management layer of SD-WAN deployments. Successful exploitation may expose administrative credentials, network configurations and managed edge infrastructure.

The Check Point vulnerability demonstrates the continued focus on security management platforms. Compromise of administrative consoles may allow attackers to modify security policies or establish persistent privileged access.

This week’s reporting also highlights public proof-of-concept activity affecting Microsoft Active Directory Certificate Services, active exploitation of WordPress websites through the WP2Shell campaign and state-sponsored attacks targeting Zimbra Collaboration Suite.

Key Vulnerabilities

Vulnerability Analysis

Arista VeloCloud Orchestrator — CVE-2026-16812

CVE-2026-16812 affects on-premises deployments of Arista VeloCloud Orchestrator.

The vulnerability allows unauthenticated operating system command execution through the management interface and has been added to the CISA Known Exploited Vulnerabilities Catalog following confirmed real-world exploitation.

Because the affected platform centrally manages SD-WAN infrastructure, successful exploitation may expose administrative credentials, certificates, routing policies and remote edge devices.

Most Relevant For

• enterprises operating distributed branch networks;
• telecommunications providers;
• managed service providers;
• organizations using centralized SD-WAN management.

How to Verify Exposure

Confirm the following:

• Is VeloCloud Orchestrator deployed on-premises?
• Is the management interface accessible from the internet?
• Has the latest security update been installed?
• Have authentication logs been reviewed?
• Are there unexplained configuration changes or outbound connections?

Required Response

Upgrade immediately.

Where patching cannot be completed immediately, isolate the management interface, restrict administrative access, preserve logs and investigate indicators of compromise before returning the platform to production.

Check Point SmartConsole — CVE-2026-16232

CVE-2026-16232 affects Check Point SmartConsole and allows authentication bypass under specific deployment conditions.

Successful exploitation may provide administrative access to the security management platform, allowing attackers to modify firewall policies or establish persistent privileged access.

Most Relevant For

• enterprise organizations;
• financial institutions;
• government agencies;
• organizations operating Check Point Security Management.

How to Verify Exposure

Confirm the following:

• Is Security Management exposed externally?
• Are Trusted Clients configured correctly?
• Has the latest Jumbo Hotfix been installed?
• Have administrative authentication logs been reviewed?
• Have recent policy changes been validated?

Required Response

Apply the latest Jumbo Hotfix immediately.

Restrict management access, review administrative activity and investigate vendor indicators of compromise where exposure is confirmed.

Microsoft SharePoint Server — CVE-2026-50522

CVE-2026-50522 affects on-premises Microsoft SharePoint Server and allows remote code execution.

Observed post-exploitation activity includes theft of ASP.NET machine keys, persistence mechanisms and deployment of additional malware.

Installing security updates alone may not eliminate attacker access where compromise occurred before remediation.

Most Relevant For

• enterprise organizations;
• government;
• healthcare;
• education;
• financial services.

How to Verify Exposure

Confirm the following:

• Is SharePoint externally accessible?
• Have the latest Microsoft updates been installed?
• Is AMSI enabled?
• Have IIS and SharePoint logs been reviewed?
• Have machine keys potentially been exposed?

Required Response

Patch affected systems immediately.

Where exposure is confirmed, conduct compromise assessment, remove malicious artefacts and rotate machine keys only after the environment has been fully cleaned.

Langflow — CVE-2026-0770

CVE-2026-0770 affects Langflow, an increasingly popular platform for building and orchestrating large language model (LLM) applications.

The vulnerability allows unauthenticated remote code execution through the validation endpoint. Public reporting confirms active exploitation targeting exposed Langflow instances.

Because Langflow often connects AI workflows with cloud platforms, APIs and business applications, successful exploitation may expose cloud credentials, API keys, environment variables and connected services.

Most Relevant For

• organizations developing AI applications;
• software vendors;
• cloud-native organizations;
• enterprises integrating LLM services into business workflows.

How to Verify Exposure

Confirm the following:

• Is Langflow deployed within the environment?
• Is the application accessible from the internet?
• Has the latest security update been applied?
• Have validation endpoint requests been reviewed?
• Have cloud credentials, API keys or environment variables potentially been exposed?

Required Response

Upgrade to the latest supported version.

Remove unnecessary internet exposure, review application logs, rotate exposed secrets and validate connected cloud services for suspicious activity.

Fortinet FortiOS SSL-VPN — CVE-2025-68686

CVE-2025-68686 affects Fortinet FortiOS SSL-VPN and has been added to the CISA Known Exploited Vulnerabilities Catalog following confirmed real-world exploitation.

SSL-VPN gateways remain attractive targets because they provide direct access to enterprise environments and frequently protect privileged administrative accounts.

Successful exploitation may allow attackers to gain unauthorized remote access and establish persistence within the network.

Most Relevant For

• enterprises using Fortinet security infrastructure;
• managed service providers;
• financial services;
• critical infrastructure;
• organizations supporting remote work.

How to Verify Exposure

Confirm the following:

• Is FortiOS SSL-VPN enabled?
• Has the latest Fortinet security update been installed?
• Is the VPN gateway accessible from the internet?
• Have authentication logs been reviewed for unusual activity?
• Have new administrator accounts or configuration changes been identified?

Required Response

Apply the latest Fortinet security updates.

Review SSL-VPN authentication logs, investigate indicators of compromise and validate the integrity of administrative accounts and security policies.

Microsoft Active Directory Certificate Services — CVE-2026-54121

CVE-2026-54121 affects Microsoft Active Directory Certificate Services (AD CS).

During the reporting period, publication of public proof-of-concept code increased the likelihood of exploitation against vulnerable enterprise environments.

Successful exploitation may allow attackers to abuse certificate services, impersonate trusted systems and ultimately compromise Active Directory.

Most Relevant For

• enterprise Active Directory environments;
• government;
• financial institutions;
• healthcare;
• organizations relying on certificate-based authentication.

How to Verify Exposure

Confirm the following:

• Is Active Directory Certificate Services deployed?
• Have the latest Microsoft updates been applied?
• Have certificate enrollment logs been reviewed?
• Are unexpected machine certificates being issued?
• Has unusual Kerberos or certificate-based authentication been detected?

Required Response

Apply Microsoft’s latest security updates.

Review certificate issuance activity, validate certificate templates and investigate unexpected authentication behaviour.

Zimbra Collaboration Suite — CVE-2025-66376

CVE-2025-66376 affects Zimbra Collaboration Suite.

Joint international advisories continue to associate active exploitation with the Russian state-sponsored threat actor LAUNDRY BEAR.

Successful exploitation may expose email communications, sensitive business information and user credentials.

Most Relevant For

• government organizations;
• education;
• research institutions;
• enterprise organizations using Zimbra.

How to Verify Exposure

Confirm the following:

• Is Zimbra Collaboration Suite deployed?
• Has the latest security update been installed?
• Have mailbox access logs been reviewed?
• Have suspicious webmail sessions been identified?
• Have indicators of compromise published by the advisory been investigated?

Required Response

Patch affected systems immediately.

Review authentication activity, investigate mailbox exports, terminate suspicious sessions and rotate credentials where compromise cannot be excluded.

Active Campaigns and Tactics

SharePoint Exploitation

Public reporting continues to describe post-exploitation activity following successful SharePoint compromise.

Observed attacker behaviour includes theft of ASP.NET machine keys, persistence mechanisms and malware deployment.

The recommended response sequence remains:

• confirm exposure;
• patch or isolate;
• validate AMSI protection;
• conduct threat hunting;
• remove malicious artefacts;
• rotate machine keys after remediation;
• verify that persistence has been eliminated.

WordPress WP2Shell

Researchers continue to observe exploitation attempts targeting vulnerable WordPress installations.

Successful attacks may result in malicious administrator creation, web shell deployment and website compromise.

Organizations should validate automatic updates, review administrator accounts and inspect web servers for unauthorized files.

LAUNDRY BEAR Activity

International cybersecurity agencies continue to attribute attacks against Zimbra Collaboration Suite to the LAUNDRY BEAR threat actor.

The campaign focuses on long-term access to enterprise communications rather than immediate disruption, reinforcing the importance of monitoring collaboration platforms alongside traditional security infrastructure.

What Deserves Attention This Week?

Enterprise IT

Priority systems:

• Microsoft SharePoint;
• Arista VeloCloud Orchestrator;
• Check Point SmartConsole;
• Fortinet FortiOS SSL-VPN.

Primary actions:

• validate installed versions;
• identify internet-facing systems;
• patch or isolate;
• review privileged activity;
• investigate indicators of compromise.

Identity Infrastructure

Priority systems:

• Microsoft Active Directory Certificate Services.

Primary actions:

• validate certificate services;
• review certificate issuance;
• investigate abnormal authentication;
• monitor privileged identities.

AI Infrastructure

Priority systems:

• Langflow;
• AI orchestration platforms;
• cloud-connected LLM services.

Primary actions:

• remove unnecessary internet exposure;
• rotate exposed API keys;
• validate connected cloud services;
• monitor application activity.

Collaboration Platforms

Priority systems:

• Microsoft SharePoint;
• Zimbra Collaboration Suite.

Primary actions:

• review authentication logs;
• investigate persistence;
• validate integrity;
• confirm remediation effectiveness.
  

  Recommended Management Actions

  Immediate Actions (0–7 Days)

  • Identify whether Arista VeloCloud Orchestrator, Microsoft SharePoint, Check Point SmartConsole, Fortinet FortiOS SSL-VPN, Langflow, Microsoft Active Directory Certificate Services or Zimbra Collaboration Suite are present in the environment.
  • Validate installed versions and determine whether affected systems are internet-facing.
  • Apply available security updates or temporarily isolate exposed systems where patching is not immediately possible.
  • Conduct compromise assessment for systems associated with confirmed active exploitation before rotating credentials, machine keys or certificates.
  • Review AI platforms and cloud-connected services for exposed API keys, environment variables and unauthorized activity.
  • Initiate incident response procedures where successful exploitation cannot be ruled out.

  Actions Within 30 Days

  • Review administrative accounts, privileged authentication events and configuration changes across affected platforms.
  • Validate segmentation of management interfaces and identity infrastructure.
  • Confirm that backup and recovery procedures have been tested for collaboration platforms, security appliances and identity services.
  • Strengthen controls protecting AI infrastructure, cloud credentials and API integrations.
  • Close or formally document any remediation exceptions that remain open.

  Strategic Actions (Within 90 Days)

  • Improve visibility of internet-facing assets through continuous attack surface management.
  • Reduce unnecessary exposure of administrative interfaces.
  • Integrate AI platforms and identity services into vulnerability management programmes.
  • Review remediation performance metrics and unresolved risks at the management level.
  • Incorporate lessons learned from active exploitation into future risk assessments and security planning.

  Enterprise Exposure Assessment

  Security teams should prioritize systems based on four factors.

  1. Active Exploitation

  A vulnerability listed in the CISA Known Exploited Vulnerabilities Catalog has already progressed beyond theoretical risk.

  Confirmed exploitation should immediately increase remediation priority.

  2. External Accessibility

  Internet-facing systems remain the highest priority.

  This includes management interfaces, VPN gateways, collaboration platforms, APIs and cloud services.

  3. Business Role

  The operational role of the affected platform should influence response priority.

  Compromise of SharePoint may affect collaboration and business information.

  Compromise of VeloCloud or Check Point may affect enterprise network management.

  Compromise of Active Directory Certificate Services may affect enterprise authentication.

  Compromise of Langflow may expose cloud services and AI workflows.

  4. Recovery Readiness

  Organizations should confirm whether affected systems can be restored safely.

  Recovery planning should include validated backups, tested restoration procedures and review of exposed credentials or cryptographic material where applicable.

  Ongoing Security Controls

  Beyond the immediate remediation cycle, security teams should:

  • maintain an accurate inventory of internet-facing and business-critical systems;
  • map technologies to system owners and dependent business services;
  • validate remediation through version checks, vulnerability scanning and configuration reviews;
  • continuously monitor administrative interfaces and privileged authentication activity;
  • conduct threat hunting when active exploitation or confirmed exposure is identified;
  • regularly test recovery procedures for critical infrastructure;
  • monitor AI platforms and cloud integrations for abnormal activity;
  • report unresolved remediation exceptions and accepted risks to management.

  Questions for Leadership

  Boards and executive teams should ask:

  • Do we operate any of the technologies covered in this report?
  • Which affected systems are accessible from the internet?
  • Have required security updates been independently verified?
  • Has threat hunting been completed for systems associated with active exploitation?
  • Do we have evidence that affected systems have not already been compromised?
  • Have exposed credentials, machine keys or certificates been rotated after remediation?
  • Are management platforms and identity infrastructure protected through network segmentation and multi-factor authentication?
  • Can critical business services be restored from validated backups?
  • Which remediation exceptions remain open, and who has accepted the associated risk?

  ISO 27001 Alignment

  The actions described in this report support several areas of an Information Security Management System (ISMS) aligned with ISO/IEC 27001, including:

  • asset inventory and ownership;
  • vulnerability management;
  • secure configuration;
  • identity and access management;
  • logging and monitoring;
  • incident response;
  • network security;
  • cryptographic controls;
  • backup and recovery;
  • business continuity;
  • risk treatment and management review.

  Evidence should be retained for every remediation activity. A statement confirming that an update has been installed is not sufficient on its own. Organizations should preserve version records, vulnerability scan results, threat hunting outcomes, access reviews and recovery validation evidence.

  ISO 9001 Alignment

  The response activities described in this report also support quality management principles under ISO 9001 by promoting:

  • clearly defined ownership;
  • controlled change management;
  • documented evidence;
  • corrective actions;
  • validation of remediation outcomes;
  • management review;
  • continual improvement.

  The objective is not simply to deploy updates but to demonstrate that remediation has successfully reduced operational risk.

  Need Help Assessing Your Exposure?

  If your organization operates any of the technologies covered in this report, identifying them is only the first step.

  The next step is understanding:

  • whether security updates have been successfully deployed;
  • whether management interfaces remain exposed to the internet;
  • whether indicators of attempted or successful compromise exist;
  • which systems should be prioritized based on operational impact.

  DIAMATIX helps organizations assess exposure, validate remediation and strengthen continuous monitoring through expert-led Security Operations Center as a Service (SOCaaS), Managed Detection and Response as a Service (MDRaaS) and Incident Response services.

  Contact our team to discuss your environment.

  Conclusion

  This week’s vulnerabilities demonstrate a clear trend: attackers continue to prioritize platforms that manage enterprise infrastructure rather than individual endpoints.

  The highest operational risks affect collaboration platforms, security management consoles, identity services, AI orchestration frameworks and remote access infrastructure. These systems often provide privileged access, broad visibility or centralized control across the organization.

  Organizations should begin by identifying whether the affected technologies are present, determine whether they are exposed to untrusted networks and prioritize remediation based on operational impact rather than severity scores alone.

  For Microsoft SharePoint, Arista VeloCloud, Check Point SmartConsole and Fortinet FortiOS, immediate patching or isolation should be combined with compromise assessment.

  For Active Directory Certificate Services, organizations should review certificate activity and privileged authentication.

  For Langflow and AI infrastructure, attention should focus on internet exposure, connected cloud services and protection of API credentials.

  The objective is to establish, with evidence, that exposure has been reduced, compromise has been investigated and critical business services can continue operating securely.

  ---

  Sources

  • ThreatScope Weekly Research
  • CISA — Known Exploited Vulnerabilities additions (July 22–28, 2026)
  • Microsoft Security Response Center (MSRC)
  • Arista Security Advisories
  • Check Point Security Advisories
  • Fortinet PSIRT
  • Microsoft Active Directory Certificate Services Security Guidance
  • NSA Joint Cybersecurity Advisory
  • WordPress Security Team
  • Vendor advisories and security research published during the reporting period

  Methodology

  This report is based on open-source threat intelligence and vulnerability intelligence, prioritizing confirmed exploitation, vendor advisories, external exposure and business criticality.

  Applicability should always be validated against the organization’s actual asset inventory, deployed software versions and configuration.

  The report does not, by itself, confirm the presence or absence of compromise.

  Trusted · Innovative · Vigilant