IT security 2026-07-17

Level Critical — 90/100 — 2026-07-17

Critical day: 16 stories ranked, 3 of the top 10 reported as actively exploited, 3 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Fortinet FortiSandbox OS Command Injection Vulnerability (90/100).

  1. Fortinet FortiSandbox OS Command Injection Vulnerability — 90/100 (CVE-2026-39808)
  2. Fortinet FortiSandbox OS Command Injection Vulnerability — 86/100 (CVE-2026-25089)
  3. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — 69/100 (CVE-2026-58644)
  4. CVE-2026-12692 — Unverified password change vulnerability in Vimesoft Inc. — 38/100 (CVE-2026-12692)
  5. CVE-2026-13448 — IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerabi… — 38/100 (CVE-2026-13448)
  6. CVE-2026-13473 — IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protec… — 38/100 (CVE-2026-13473)
  7. CVE-2026-14501 — IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code o… — 38/100 (CVE-2026-14501)
  8. shivammathur setup php: setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tool… — 38/100 (CVE-2026-46420)
  9. CVE-2026-8297 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Inf… — 38/100 (CVE-2026-8297)
  10. Sangoma Switchvox SQL Injection Vulnerability — 36/100 (CVE-2026-9586)