Security News Bulletin - August 2026

WordPress Core Pre-Authentication Remote Code Execution

CVE-2026-63030

Published: 2026-07-17 
Updated: 2026-07-18  

Vendor: WordPress 
Product: WordPress

Attack Tags: Remote Code Execution (RCE), WordPress Core, REST API, Route Confusion, SQL Injection, Unauthenticated Attack.

Severity: Critical (CVSS 9.8)

What Is CVE-2026-63030?
 

CVE-2026-63030 is a critical vulnerability in WordPress Core that forms part of the "wp2shell" exploit chain. The flaw exists in the REST API batch endpoint, where route confusion allows specially crafted requests to bypass intended request handling. When combined with CVE-2026-60137 (a SQL injection vulnerability in WP_Query), an unauthenticated attacker can achieve remote code execution (RCE) on a default WordPress installation — without requiring plugins, authentication or special configuration. 

Affected Versions 

• affected from 6.9.0 before 6.9.5 
• affected from 7.0.0 before 7.0.2  

Observed Attack Activity 

Security researchers have confirmed active exploitation in the wild. Public proof-of-concept (PoC) exploits are available, and attackers have been scanning the internet for vulnerable WordPress installations shortly after disclosure. 

Unlike most WordPress vulnerabilities that affect third-party plugins or themes, CVE-2026-63030 impacts the WordPress Core itself. Since it requires no authentication and no plugins, it represents one of the most significant WordPress vulnerabilities disclosed in recent years. Organizations running vulnerable versions should apply security updates immediately and verify that automatic updates have been successfully installed. 

 Successful exploitation can allow attackers to: 

• Execute arbitrary code on the server
• Create administrator accounts
• Install web shells or malware
• Fully compromise WordPress websites

Additional Resources  

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-63030 

2. National Vulnerability Database (NVD) 
   https://nvd.nist.gov/vuln/detail/CVE-2026-63030 

3. WordPress Security Release (7.0.2 / 6.9.5) 
   https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ 

4. Akamai Security Research — wp2shell Analysis 
   https://www.akamai.com/blog/security-research/wordpress-unauthenticated-rce-cve-2026-63030-cve-2026-60137 

---

SAP NetWeaver Memory Corruption Vulnerability

CVE-2026-44747

Published: 2026-07-14 
Updated: 2026-07-29  

Vendor: SAP_SE 
Product: SAP NetWeaver Application Server ABAP

Attack Tags: Memory Corruption, Out-of-Bounds Write, Authenticated Remote Attack, Data Manipulation, Unauthorized Data Access.

Severity: Critical (CVSS 9.9)

What Is CVE-2026-44747?
 

CVE-2026-44747 is a critical memory corruption vulnerability affecting SAP NetWeaver Application Server ABAP. The vulnerability is caused by logical errors in memory management that can allow an authenticated attacker with low privileges to trigger an out-of-bounds write, potentially corrupting application memory. 

Successful exploitation could allow an attacker to access or modify sensitive data and cause system unavailability, with high impact to the confidentiality, integrity, and availability of the affected SAP system. 

Affected Versions 

• affected at KRNL64NUC 7.22
• affected at 7.22EXT
• affected at KRNL64UC 7.22
• affected at 7.53
• affected at KERNEL 7.22
• affected at 7.53, 7.54
• affected at 7.77
• affected at 7.93
• affected at 9.16
• affected at 9.18
• affected at 9.19
• affected at 9.20 

Observed Attack Activity 

No confirmed active exploitation has been reported at the time of this newsletter. CISA's SSVC assessment currently records exploitation as "none", and available vulnerability intelligence reports no known public exploit. However, the vulnerability should be treated as high priority because of its CVSS 9.9 Critical rating, network attack vector, and potential impact on confidentiality, integrity, and availability; therefore, organizations should patch affected SAP systems immediately. 

 Indicators of Compromise are: 

• Unexpected SAP application crashes or restarts
• Abnormal memory-related errors
• Unexpected changes to sensitive SAP data
• Suspicious activity from low-privileged authenticated accounts
• Unusual requests to exposed SAP NetWeaver services

Additional Resources  

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-44747 

2. SAP Security Patch Day 
   https://support.sap.com/en/search-results.html?isu_keyword=CVE-2026-44747&isu_page=1 

3. SentinelOne 
   https://www.sentinelone.com/vulnerability-database/cve-2026-44747/ 

4. The Hacker News 
   https://thehackernews.com/2026/07/sap-patches-cvss-99-netweaver-abap-flaw.html 

---

Microsoft AD FS Privilege Escalation Vulnerability

CVE-2026-56155

Published: 2026-07-14 
Updated: 2026-08-20  

Vendor: Microsoft 
Product: Windows 10 (Version 1607, 1809), Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025)

Attack Tags: Privilege Escalation, Local Privilege Escalation, Access Control Bypass, Insufficient Access Control, Post-Compromise Exploitation.

Severity: High (CVSS 7.8)

What Is CVE-2026-56155?
 

CVE-2026-56155 is a high-severity privilege escalation vulnerability in Microsoft Active Directory Federation Services (AD FS), the identity federation service that bridges on-premises Active Directory with cloud services like Microsoft 365 and Azure AD. The flaw is tied to insufficiently granular permissions on the AD FS Distributed Key Manager (DKM) container, an Active Directory object that AD FS relies on to store the symmetric keys protecting the private keys of token-signing and token-encryption certificates. 

The vulnerability is caused by insufficient granularity of access control (CWE-1220) on the AD FS Distributed Key Manager (DKM) container's ACL. When the container's permissions are overly permissive, an authorized attacker with low privileges can exploit this locally to perform actions with higher privileges than intended. 

Affected Versions 

Windows 10 Version 1607 

• affected from 10.0.14393.0 before 10.0.14393.9339  

Windows 10 Version 1809 

• affected from 10.0.17763.0 before 10.0.17763.9020  

Windows Server 2012 

• affected from 6.2.9200.0 before 6.2.9200.26226  

A few other products and versions are also affected. For additional information, please refer to: https://www.cve.org/CVERecord?id=CVE-2026-56155 

Observed Attack Activity 

Active exploitation has been confirmed. Security researchers reported that attackers were exploiting the AD FS flaw after obtaining a low-privileged local foothold, using it to escalate privileges. 

 Indicators of Compromise are: 

• Unexpected privilege elevation involving AD FS processes
• Suspicious activity from low-privileged accounts
• Unexpected changes to AD FS configuration or permissions
• Unusual local process execution with elevated privileges
• Authentication or federation activity inconsistent with normal behavior

Additional Resources  

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-56155 

2. Microsoft Security Advisory 
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 

3. CISA 
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155& 

---

Microsoft SharePoint Remote Code Execution

CVE-2026-58644

Published: 2026-07-14 
Updated: 2026-08-20  

Vendor: Microsoft 
Product: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Attack Tags: Remote Code Execution, Deserialization of Untrusted Data, Unauthenticated Exploitation, Network Attack, Zero-Day Exploitation

Severity: Critical (CVSS 9.8)

What Is CVE-2026-58644?
 

CVE-2026-58644 is a critical remote code execution vulnerability affecting Microsoft SharePoint Server. The flaw is caused by deserialization of untrusted data, allowing an unauthenticated attacker to send specially crafted requests over the network and execute arbitrary code on a vulnerable SharePoint server. 

Microsoft's advisory states that in a network-based attack, an attacker authenticated as at least a Site Owner could write arbitrary code to inject and execute code remotely on the SharePoint Server. Microsoft notes attack complexity is low because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component. 

Affected Versions 

Microsoft SharePoint Enterprise Server 2016 

• affected from 16.0.0 before 16.0.5556.1005  

Microsoft SharePoint Server 2019 

• affected from 16.0.0 before 16.0.10417.20153  

Microsoft SharePoint Server Subscription Edition 

• affected from 16.0.0 before 16.0.19725.20384  

Observed Attack Activity 

Active exploitation has been confirmed. Microsoft has also reported that CVE-2026-58644 was exploited in the wild as a zero-day before patches became available. The vulnerability is particularly significant for internet-exposed SharePoint environments, because exploitation can occur remotely without authentication. Security teams should therefore treat exposed and unpatched SharePoint servers as high-priority assets for remediation and investigation. 

 Indicators of Compromise are: 

• Unusual requests to externally accessible SharePoint servers
• Suspicious or unexpected processes spawned by SharePoint/IIS
• Unexpected PowerShell or command-line activity from SharePoint servers
• Unauthorized modifications to SharePoint files or configuration
• Abnormal outbound connections from SharePoint servers
• Unexpected administrative or service-account activity

Additional Resources  

1. Official CVE Record – CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-58644 

2. Microsoft Security Advisory 
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 

3. CERT-EU Security Advisory 
   CERT-EU - Critical Vulnerabilities in Microsoft SharePoint 

---

Microsoft SharePoint Authentication Bypass

CVE-2026-56164

Published: 2026-07-14 
Updated: 2026-08-20  

Vendor: Microsoft 
Product: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Attack Tags: Authentication Bypass, Privilege Escalation, Unauthorized Access, Remote Exploitation, Missing Authentication.

Severity: Medium (CVSS 5.3)

What Is CVE-2026-56164?
 

CVE-2026-56164 is an authentication vulnerability affecting Microsoft SharePoint Server. The flaw is classified as CWE-306 – Missing Authentication for Critical Function and allows an unauthenticated attacker to access a critical SharePoint function over the network. Successful exploitation can allow the attacker to elevate privileges and gain unauthorized access to an affected on-premises SharePoint Server. 

Affected Versions 

Microsoft SharePoint Enterprise Server 2016 

• affected from 16.0.0 before 16.0.5561.1001  

Microsoft SharePoint Server 2019 

• affected from 16.0.0 before 16.0.10417.20175  

Microsoft SharePoint Server Subscription Edition 

• affected from 16.0.0 before 16.0.19725.20434  

Observed Attack Activity 

Active exploitation has been confirmed. Microsoft reported that CVE-2026-56164 was being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities (KEV) Catalog on July 14, 2026. CISA's assessment records exploitation as active, with the vulnerability considered remotely exploitable and automatable. Security advisories indicate that attackers have targeted on-premises SharePoint Server instances. The activity appears to have been targeted rather than a broad, indiscriminate campaign. 

 Indicators of Compromise are: 

• Unusual unauthenticated requests to SharePoint endpoints
• Suspicious POST requests targeting SharePoint
• Unexpected privilege escalation or administrative activity
• Unusual changes to SharePoint configuration or content
• Suspicious outbound connections from SharePoint servers
• Unexpected IIS/SharePoint process activity

Additional Resources  

1. Official CVE Record — CVE.org 
   CVE Record: CVE-2026-56164 

2. Microsoft Security Advisory 
   CVE-2026-56164 - Security Update Guide - Microsoft - Microsoft SharePoint Server Elevation of Privilege Vulnerability 

3. National Vulnerability Database 
   https://nvd.nist.gov/vuln/detail/CVE-2026-56164 

Back to Newsletter Home