Researchers at Wiz found that a public Snowflake code repository could be hijacked through nothing more than a crafted GitHub issue title. A workflow that ran when issues were opened dropped the attacker-controlled title straight into a command, so an unauthenticated user could run code on the GitHub Actions runner and steal a Jira API token used by the automation. The notable twist is how the bug arrived: it was introduced days earlier by an AI tool meant to fix security issues, and an AI code reviewer approved the change. Snowflake fixed it by passing the title safely as an argument rather than expanding it into a command.
Adobe released Priority 1 updates for ColdFusion and Campaign Classic, led by a critical operating-system command injection flaw in ColdFusion scored 10.0 that could give an attacker arbitrary code execution. Tracked as CVE-2026-48362, it is accompanied by an eval-injection flaw scored 9.9 and an authorization flaw that can cause a denial of service. ColdFusion application servers are a long-standing target for attackers because they are widely internet-exposed and often run with broad access. Adobe is not aware of exploitation yet but urges installation within 72 hours given the priority rating. The Campaign Classic updates apply only to on-premises and hybrid on-premises deployments.
CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.
Cisco released fixes for twelve flaws in Catalyst SD-WAN and IOS XE software, including three rated 9.9 and a command-injection issue rated 9.8. The three critical SD-WAN flaws, CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, stem from improper input validation, access control, and file-path handling in software that centrally controls a network. Cisco found them through internal testing that included frontier AI models and is not aware of exploitation, but there are no workarounds, so patching is the only remediation. Cisco also patched a management-controller flaw with public exploit code that lets a low-privileged user reach root.
Arista patched a critical vulnerability in on-premises VeloCloud Orchestrator, the console that configures and manages VeloCloud SD-WAN deployments, that is already being exploited. Tracked as CVE-2026-16812 and scored 10.0, it is an unauthenticated operating-system command injection that lets a remote attacker reach privileged functionality meant only for internal use. Arista warns successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and everything it manages. There is no configuration that prevents exposure, since the web interface is reachable by default. CISA added it to its exploited-vulnerabilities catalog. Hosted and Dedicated deployments were fixed before the advisory and are not affected.
CISA has added two critical Fortinet FortiSandbox vulnerabilities to its exploited-vulnerabilities catalog and ordered federal agencies to patch them by July 19. Tracked as CVE-2026-39808 and CVE-2026-25089, both are operating-system command injection flaws that let an unauthenticated attacker run commands remotely with low complexity and no user interaction. Fortinet disclosed and fixed them in April and June, and threat intelligence firm Defused reported in-the-wild abuse of FortiSandbox flaws in June. FortiSandbox is a threat-detection appliance, and Fortinet gear sits at many network edges, so these devices are a recurring target in espionage and ransomware campaigns, making prompt patching important.
Ubiquiti has released fixes for 25 vulnerabilities across its UniFi ecosystem, including several critical flaws that let a network-based attacker fully compromise devices. The most severe, CVE-2026-50746 rated 10.0, is an improper access-control bug in the UniFi Connect application that allows unauthenticated command injection on the host. Others rated 9.9, spanning UniFi Talk, Access, Protect, and UniFi OS, include SQL injection, command injection, and server-side request forgery that lead to privilege escalation, and some can be chained to bypass authentication requirements. The flaws affect widely deployed gateways and consoles like the UDM family. Ubiquiti lists no interim workarounds, so updating each affected product to its fixed version is the only mitigation.
Fortinet has patched a critical flaw in FortiSandbox, the appliance that detonates suspicious files and feeds malware verdicts to the rest of a Fortinet security deployment. The bug (CVE-2026-25089, rated 9.8) is an OS command injection in the web interface that lets a remote, unauthenticated attacker run arbitrary commands by sending crafted HTTP requests. Compromising a sandbox is especially dangerous because attackers can both pivot deeper into the network and blind the very system meant to catch malware. Fixed versions are FortiSandbox 5.0.6 and 4.4.9, with matching updates for the Cloud and PaaS editions.
Ubiquiti has shipped patches for five UniFi OS vulnerabilities, three of which are CVSS-maximum and exploitable by remote unauthenticated attackers. CVE-2026-34908 is an improper access control that lets attackers make unauthorized changes; CVE-2026-34909 is a path traversal that reaches an underlying system account; CVE-2026-34910 is an unauthenticated command injection. Two additional flaws (CVE-2026-33000, a critical command injection, and CVE-2026-34911, a high-severity info disclosure) were also patched. All five came through Ubiquiti's HackerOne program. Censys is tracking close to 100,000 internet-exposed UniFi OS endpoints, around 50,000 of them in the US. Ubiquiti products were previously hijacked into the GRU-operated Moobot botnet.
Atlassian's April 21 security bulletin disclosed CVE-2026-21571, a critical OS command injection in Bamboo Data Center and Server with CVSS 9.4. An authenticated attacker can execute arbitrary commands on the underlying server, leading to full system compromise and lateral movement. Affected branches: 9.6, 10.0, 10.1, 10.2, 11.0, 11.1, 12.0, 12.1. The same bulletin patches CVE-2026-33871 (CVSS 8.7) - a Netty HTTP/2 DoS that can knock CI/CD pipelines offline. Bamboo sits at the heart of build pipelines, giving attackers a clean path to tamper with artifacts and harvest pipeline secrets.
TrustStrike Labs