By SAFE Threat Research Team
This week’s exploitation activity shows how quickly newly disclosed vulnerabilities can move from patch release to real-world attacks. WordPress wp2shell moved from disclosure and public availability of exploits to active exploitation within hours, with widespread attack activity following shortly after. The recently disclosed ServiceNow AI Platform RCE is also now being targeted in the wild. At the same time, SonicWall SMA1000 appliances were found to be compromised via zero-day exploits before patches became available, with attackers establishing persistent access and attempting to move deeper into victim environments.
The pattern is reflected in this week’s exploitation data. Of the 12 CVEs with confirmed exploitation signals, 8 are newly published in-the-wild exploited vulnerabilities, a notable shift from recent weeks, where older vulnerabilities accounted for most observed exploitation. Microsoft SharePoint and AD FS, Oracle E-Business Suite, and other enterprise technologies also entered the exploitation picture, putting remote access, collaboration, identity, business applications, and internet-facing web platforms in focus.
For security teams, the priority is not simply the number of vulnerabilities disclosed. The stronger signal is where active exploitation, public availability of exploits, external exposure, and the business importance of the affected system intersect. This week’s activity reinforces how little time defenders may have to assess exposure once exploit details become public.
Vulnerability Landscape
This week’s vulnerability volume rose sharply, with 2,654 CVEs published, including 1,371 rated critical or high severity. Of the total, 158 have a public exploit or proof of concept available, while 11 carry stronger weaponized exploit signals.
The disclosure volume is significant, but the more useful signal comes from narrowing those thousands of vulnerabilities to the subset that attackers can realistically use. Public exploitability, weaponization, and confirmed exploitation provide a much stronger basis for determining which vulnerabilities should move first in remediation queues.
Trending Vulnerabilities
Twelve CVEs showed confirmed exploitation activity this week, with eight newly published vulnerabilities and four pre-existing CVEs.
That split marks a change from recent weeks, when exploitation was dominated by vulnerabilities that had already been public for some time.
Top CVEs to Watch
WordPress wp2shell CVE-2026-63030, CVE-2026-60137: Pre-Auth RCE Chain Moves Into Active Exploitation
CVE-2026-63030 and CVE-2026-60137, collectively known as wp2shell, are vulnerabilities in WordPress Core that can be chained to achieve unauthenticated remote code execution against affected WordPress installations. The chain combines a REST API batch-route confusion issue with a SQL injection vulnerability and can be exploited against a standard WordPress installation without requiring a vulnerable plugin or theme. WordPress 6.9.x and 7.0.x installations are affected by the complete RCE chain.
The exploitation window compressed rapidly after disclosure on July 17. Public proof-of-concept exploits appeared within hours, followed by successful exploitation targeting credential hashes, then remote code execution, as additional technical details became available. Exploitation activity has since broadened, with scanning and attacks observed across organizations in multiple regions.
The speed from disclosure to public exploitation makes WP2Shell one of this week’s highest-priority vulnerabilities. Organizations should update affected WordPress installations immediately, including upgrading WordPress 7.0 to 7.0.2 and WordPress 6.9 to 6.9.5, and investigate systems that remained exposed after exploit code became public.
SonicWall SMA1000 CVE-2026-15409, CVE-2026-15410: Zero-Day Chain Leads to Root-Level Appliance Compromise
CVE-2026-15409 and CVE-2026-15410 affect SonicWall SMA1000 appliances and were exploited as zero-days before patches became available. CVE-2026-15409 is a critical SSRF vulnerability that can allow an unauthenticated attacker to reach otherwise inaccessible services on the appliance, while CVE-2026-15410 is a command-injection vulnerability that can be used to execute operating-system commands. SonicWall has confirmed active exploitation of both vulnerabilities.
Observed attacks have been attributed to UTA0533, with compromise activity dating back to at least June 2026. Attackers used multiple vulnerabilities to obtain root-level access and deployed ROOTRUN, KNUCKLEBALL, and ORANGETAIL, establishing persistent access directly on compromised VPN appliances. Subsequent activity included capturing unencrypted LDAP traffic to obtain credentials and attempting to pivot from the SMA appliance into other systems within the victim networks.
Because the attacks established persistence on the appliances themselves, remediation should extend beyond applying the hotfix. Organizations should prioritize affected internet-facing SMA1000 deployments, review appliance integrity and available indicators of compromise, and follow recommended credential and authentication-token reset procedures where compromise is suspected.
ServiceNow AI Platform CVE-2026-6875: Pre-Auth Code Execution Moves Into Active Exploitation
CVE-2026-6875 is a critical code-execution vulnerability affecting the ServiceNow AI Platform. The flaw can, under certain conditions, allow an unauthenticated attacker to escape the platform’s sandbox and execute arbitrary code within the ServiceNow environment. Security updates have been deployed to hosted instances and made available for affected self-hosted deployments.
Recent attack telemetry indicates that exploitation began only days after public disclosure. Observed attacks target the same pre-authentication attack surface associated with the vulnerability, but use an exploitation path that differs from the publicly documented proof of concept, indicating that attackers are already adapting the technique for real-world use.
The rapid move toward exploitation increases the urgency of adopting self-hosted environments that have not yet applied the available fixes. Given ServiceNow’s role in enterprise workflows and its connectivity to other business systems, organizations should confirm patch status and investigate vulnerable instances that remained exposed after disclosure.
Microsoft SharePoint CVE-2026-58644, CVE-2026-56164: Newly Disclosed Flaws Move Quickly Into Active Exploitation
Two vulnerabilities affecting on-premises Microsoft SharePoint Server entered active exploitation shortly after disclosure.
CVE-2026-58644 is a critical deserialization vulnerability that allows an unauthenticated attacker to execute code remotely against affected on-premises SharePoint servers. Microsoft disclosed the vulnerability on July 14, and CISA added it to KEV just two days later, following evidence of active exploitation. The flaw affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
CVE-2026-56164 is a missing-authentication vulnerability that allows an unauthenticated network attacker to elevate privileges. The vulnerability is already being exploited and was added to CISA KEV on the day it was disclosed. That combination of unauthenticated access and confirmed exploitation makes its operational priority considerably higher than the severity rating alone suggests.
The rapid movement from disclosure to exploitation reinforces the continued attacker focus on self-hosted SharePoint infrastructure. Organizations should prioritize July security updates across supported on-premises deployments and investigate exposed systems for signs of compromise rather than treating patching alone as sufficient.
Oracle E-Business Suite CVE-2026-46817: Active Exploitation Targets Oracle Payments
CVE-2026-46817 is a critical vulnerability in the File Transmission component of Oracle Payments within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. The vulnerability can be exploited remotely over HTTP without authentication, resulting in the takeover of the Oracle Payments component. It carries a CVSS score of 9.8.
The vulnerability was patched in May but was added to the Known Exploited Vulnerabilities catalog on July 15 following evidence of active exploitation. The delay between patch availability and exploitation is an important reminder that previously disclosed vulnerabilities can quickly become operational threats when vulnerable enterprise applications remain reachable.
Because Oracle E-Business Suite supports financial and other business-critical operations, organizations should prioritize affected Oracle Payments deployments, verify that the May security update has been applied, and assess externally accessible systems that remained vulnerable after exploitation activity began.
Microsoft AD FS CVE-2026-56155: Exploited Privilege Escalation Targets Federated Identity Infrastructure
CVE-2026-56155 is an actively exploited privilege-escalation vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from insufficient access-control granularity and allows an attacker with low-privilege local access to elevate to administrative privileges on the affected system. Microsoft rates it CVSS 7.8, and CISA added the vulnerability to KEV following confirmation of active exploitation.
Although exploitation requires existing access, compromise of an AD FS server carries higher operational significance because these systems sit within the enterprise authentication and federation infrastructure.
Organizations running AD FS should prioritize Microsoft’s July security updates and review affected servers for evidence of unauthorized privilege escalation, particularly where an attacker may already have established an initial foothold.
From Exploitation Trends to Remediation Priorities
This week’s activity shows that the remediation window is getting shorter. Eight of the 12 CVEs with confirmed exploitation signals were newly published, while several moved from disclosure and public availability of exploits to real-world attacks within days. For security teams, waiting for routine patch cycles becomes increasingly risky when affected systems are internet-facing or sit at critical points in the enterprise environment.
Remediation priorities should focus on:
- Immediately address the active exploitation of internet-facing systems, particularly WordPress, SonicWall SMA1000, ServiceNow AI Platform, and Microsoft SharePoint deployments.
- Prioritize vulnerabilities that enable pre-authentication code execution, provide privileged access, or grant control over high-value infrastructure, even if their CVSS score is not the highest in the queue.
- Treat exploited edge and identity infrastructure as potential compromise points, not just patching targets. SonicWall SMA1000 and AD FS systems should be reviewed for evidence of credential access, persistence, privilege escalation, or attempts to move further into the environment.
- Validate exposure before relying on patch status alone. Determine whether vulnerable services were reachable during the exploitation window and whether compensating controls materially reduced the attack path.
- Perform compromise assessments where exploitation preceded remediation. For vulnerabilities such as wp2shell, SonicWall SMA1000, SharePoint, and ServiceNow, patching closes the vulnerability but does not remove access that an attacker may already have established.
The key takeaway this week is not simply that more newly disclosed vulnerabilities are being exploited. It is how quickly disclosure, weaponization, and active exploitation are converging.
SAFE CTEM helps security teams connect these threat signals with actual exposure, asset criticality, exploitability, and existing controls. The goal is to move beyond severity-driven patching and focus on remediation where an exploitable vulnerability creates a credible path to meaningful business impact.
