Product & Security Tips — SamHouston (Veracode) asked a question.
Written by Andrea Mazzarini, Senior Principal CSM at Veracode
Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!
https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips
Executive Summary
Top threats (2026-07-20 sweep):
- Fortinet FortiSandbox OS Command Injection (CVE-2026-39808, CVE-2026-25089): Critical unauthenticated RCE (CVSS 9.1). KEV added 2026-07-16. Atomic Risk 9/10. First-principles: Security appliance compromise undermines malware analysis, enables persistence/defense evasion, and provides high-value initial access for ransomware/APT. Strong Veracode applicability (exposed management interfaces).
- Microsoft SharePoint Server Deserialization/Missing Authentication (CVE-2026-58644, CVE-2026-56164 and related): RCE/privilege escalation. Multiple KEV additions mid-July 2026. Atomic Risk 8/10. Enterprise collaboration platform — prime target for data theft, ransomware deployment, and lateral movement. High blast radius in on-prem/exposed deployments.
- SonicWall SMA1000 Code Injection/SSRF (CVE-2026-15410, CVE-2026-15409): Remote code execution and request forgery. KEV added 2026-07-14. Atomic Risk 8/10. Perimeter appliances frequently targeted for initial access.
- WordPress wp2shell RCE (public PoC, emergency patches 2026-07-17): Critical remote code execution chaining REST API + SQL injection. Affects WP 6.9.0–6.9.4 and 7.0.0–7.0.1. Atomic Risk 8/10. Millions of sites; public exploit available. Strong DAST alignment.
- Ongoing multi-group ransomware campaigns (Qilin, Nova, Unsafe, Chaos, Doommageddon): Daily victim disclosures July 19–20 2026 across manufacturing, healthcare, construction, and other sectors. Atomic Risk 7/10. Steady high volume; groups actively posting. No single new dominant campaign but consistent operational tempo.
Comprehensive Threats Table
Detailed First-Principles Analysis (Top Items)
Fortinet FortiSandbox (CVE-2026-39808 / CVE-2026-25089):
Root cause is CWE-78 (improper neutralization of special elements in OS command) in web UI (e.g., "start VNC") and API endpoints. Attacker sends crafted unauthenticated HTTP request → arbitrary command execution on the appliance. Blast radius: Full system compromise of a malware analysis/sandbox platform. Attacker gains access to analyzed samples (potential tampering or exfil), can disable or evade detection, establish persistence, and use the appliance as a pivot point. Not a worm (no self-propagation), but extremely high-value target for ransomware operators or APTs seeking to blind security teams. Veracode control point: EASM discovers internet-exposed management consoles; DAST tests analogous command injection in custom web apps; Risk Manager tracks KEV remediation SLAs and correlates risk.
Microsoft SharePoint (CVE-2026-58644 et al.):
Classic deserialization of untrusted data + missing authentication for critical functions. Leads to unauthenticated or low-priv RCE. Blast radius: Enterprise-wide — document repositories, user data, workflow automation, and potential domain-level impact via integration. Frequently used in ransomware and nation-state operations for initial foothold or data staging. Propagation risk moderate via compromised accounts or lateral movement scripts. Veracode: EASM for exposed instances; Risk Manager for unified KEV + AppSec risk scoring; DAST for runtime validation of SharePoint-like custom portals.
Ransomware campaigns:
Root cause typically unpatched edge vulnerabilities (exactly the KEV class above), stolen creds, or phishing. Mechanism: Initial access → discovery/lateral movement → encryption + exfil. Blast radius: Organization-wide operational shutdown, regulatory exposure, and ransom demand. High blast because modern groups combine speed with data leverage. No direct tie to today's new KEVs in public reporting, but the pattern matches perfectly. Veracode reduces success probability by shrinking the vulnerable external surface (EASM) and enforcing rapid KEV remediation (Risk Manager).
Broader Signals
Ransomware tracking platforms show consistent daily activity (~14 new incidents in last 24h window per live feeds) with groups actively naming victims. X volume on specific CVEs/KEVs remains low-signal in latest mode (early post-KEV phase). No credible reports of new worm variants, Mini-Shai-Hulud-style OSS propagation, or large-scale credential-harvesting malware in public OSS registries during the sweep window. APT activity historically targets SharePoint and perimeter appliances; continued monitoring warranted but no new nation-state campaign indicators surfaced today.
Veracode Tool Reference with Links
- SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
- Risk Manager (unified risk prioritization with CISA KEV context):
- Veracode Fix (AI remediation for SAST/SCA):
- SAST (custom code vulnerabilities):
- DAST (runtime web app and API testing):
- EASM (external attack surface discovery):
- Container Security:
- Policy Management (governance and enforcement):
Daily Threat Intel Brief | LinkedIn
Daily curated threats with CVSS context and actionable AppSec recommendations for security leaders.
https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
.png){kind=logo}
Veracode Recommendations
Malicious Packages & Supply Chain Worms
Threats: None new critical confirmed in last 7–14 days. Why fits: SCA + Package Firewall provides real-time blocking of malicious/trojanized packages at ingestion and in pipelines. Customer action: Confirm Package Firewall policies are active and enforcing "block on malicious" + "quarantine on high-risk" across all npm/PyPI/GitHub feeds in CI/CD. Review any recent dependency changes. Tool: SCA + Package Firewall
New/KEV CVEs
Threats: Fortinet FortiSandbox (CVE-2026-39808/25089), Microsoft SharePoint (CVE-2026-58644/56164+), SonicWall SMA1000 (CVE-2026-15410/15409), Oracle EBS, and related July 2026 KEV additions. Why fits: Risk Manager ingests CISA KEV data, applies unified risk scoring, and tracks remediation SLAs across all AppSec tools. EASM discovers externally exposed vulnerable assets (critical for appliances and collaboration platforms). Customer action: In Risk Manager, add/filter new KEV items, assign owners, and enforce 24–48h SLAs for critical external assets. Trigger EASM scan targeting Fortinet, SharePoint, and SonicWall keywords/IP ranges. Tool: Risk Manager (KEV) + EASM
Web/Runtime Exploits
Threats: WordPress wp2shell RCE (public PoC), FortiSandbox web UI/API command injection, SharePoint deserialization issues. Why fits: DAST executes real attack simulations against running web apps and APIs to surface exploitable RCE, command injection, and deserialization flaws. Veracode Fix accelerates remediation of identified issues. Customer action: Run targeted/on-demand DAST scans on all external web apps, SharePoint portals, WordPress instances, and security appliance consoles. Prioritize results matching wp2shell or command-injection patterns. Tool: DAST + Veracode Fix
Custom Code
Threats: Any internal applications mirroring patterns from above (user-controlled command execution, deserialization, unrestricted file upload). Why fits: SAST identifies vulnerable code patterns at development time; Veracode Fix provides AI-guided fixes. Customer action: Run SAST on codebases handling external input or integrations with SharePoint/Fortinet-like surfaces; apply Fix recommendations on high-severity findings. Tool: SAST + Fix
External Attack Surface
Threats: Exposed FortiSandbox, SharePoint, SonicWall, and WordPress instances (primary vectors for ransomware/APT initial access). Why fits: EASM continuously maps and risk-scores internet-facing assets, enabling rapid discovery of vulnerable perimeter devices. Customer action: Execute EASM discovery focused on security appliances, collaboration platforms, and public web properties; immediately flag and isolate any KEV-affected assets. Tool: EASM
Containers
Threats: Containerized deployments of WordPress, custom web apps, or any self-managed instances of affected enterprise software. Why fits: Container Security scans images and runtime for vulnerabilities and misconfigurations. Customer action: Scan all container images and Kubernetes workloads that include WordPress or web app components; enforce policies blocking deployment of vulnerable base images. Tool: Container Security
Governance
Threats: Inconsistent KEV remediation timelines and external exposure of high-risk assets. Why fits: Policy Management enforces organization-wide rules, SLAs, and compliance gates across all Veracode tools. Customer action: Update AppSec policies to mandate 48-hour remediation for new critical KEVs on externally reachable assets and require EASM + DAST coverage for all internet-facing applications. Tool: Policy Management
Prioritized Action Plan (SMART, executable today)
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.