IT security 2026-07-16

Level Critical — 94/100 — 2026-07-16

Critical day: 18 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Fortinet FortiSandbox OS Command Injection Vulnerability (89/100).

1. Fortinet FortiSandbox OS Command Injection Vulnerability — 89/100 (CVE-2026-39808)
2. Fortinet FortiSandbox OS Command Injection Vulnerability — 81/100 (CVE-2026-25089)
3. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — 69/100 (CVE-2026-58644)
4. Oracle E-Business Suite Improper Privilege Management Vulnerability — 68/100 (CVE-2026-46817)
5. KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability — 62/100 (CVE-2023-4346)
6. CVE-2026-44181 — Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache S… — 39/100 (CVE-2026-44181)
7. CVE-2026-44182 — Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache S… — 39/100 (CVE-2026-44182)
8. netfoundry zrok: zrok is software for sharing web services, files, and network resources. — 38/100 (CVE-2026-45568)
9. spaceapplications yamcs: Yamcs is a mission control framework. — 38/100 (CVE-2026-44596)
10. hcltech dfxanalytics: HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. — 38/100 (CVE-2026-56453)