Monthly exploitation report · July 2026
Monthly analysis of new exploited vulnerabilities added to KEVIntel and exploitation attempts observed by sensors.
39 were outside CISA KEV when added
Up 383.1% from June
Share of events tied to five CVEs
Across 16 CVEs added by KEV Intelligence first
Executive brief
Five CVEs produced 59.8% of July events. Prioritize asset discovery and remediation around Sentry, Apache HTTP Server, ThinkPHP Framework, react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, and Langflow.
KEV Intelligence added 39 exploited CVEs outside CISA KEV during July; 25 were still absent at month-end.
Event volume and source breadth help identify pressure, but observations do not prove that a real-world target was compromised or represent all exploitation activity worldwide.
Exploitation activity
KEV Intelligence sensors recorded 29,210 exploitation events in July, up from 6,046 in June. A small set of vulnerabilities drove most of the observed volume.
Observed exploitation events
June versus July 2026
107
CVEs observed
2,687
Source IPs
43
First observed
For CISOs, this concentration supports a focused exposure-validation and remediation sprint rather than treating every observed CVE as equally urgent.
Visibility before CISA KEV
Sixteen vulnerabilities were added by KEV Intelligence before later inclusion in CISA KEV. The median lead time was 1.4 days; the longest was 34.1 days.
1.4 days
Median positive lead
25
Still absent at month-end
Most targeted
Ranked by sensor-observed exploitation events. Event volume shows intensity; unique source IPs help indicate breadth.
19.3% of monthly events
16.3% of monthly events
14.5% of monthly events
Meta · react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel
In CISA KEV
5.2% of monthly events
4.5% of monthly events
3.6% of monthly events
3.4% of monthly events
Progress Software · LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF
Outside CISA KEV at month-end
3.4% of monthly events
2.5% of monthly events
2.1% of monthly events
Vendor exposure
Microsoft
4 outside CISA KEV when added
Cisco
1 outside CISA KEV when added
FlowiseAI
2 outside CISA KEV when added
Fortinet
1 outside CISA KEV when added
SonicWall
1 outside CISA KEV when added
Weakness patterns
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Most common newly added weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
4 newly added KEVs
CWE-502 · Deserialization of Untrusted Data
4 newly added KEVs
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
4 newly added KEVs
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
4 newly added KEVs
53.1%
Critical severity
111
Public PoC references
90
Nuclei references
106
Observed request paths
Methodology and limitations
These notes define the reporting window, what sensor observations mean, and where the dataset should not be generalized.
Full KEV Intelligence methodologyReporting period is 2026-07-01 00:00:00 UTC through 2026-07-31 23:59:59 UTC.
KEVIntel sensor telemetry represents activity observed by the KEVIntel sensor network. It does not represent all exploitation activity occurring globally.
An observed exploitation attempt does not by itself demonstrate that a real-world target was successfully compromised.
CISA KEV status at month-end is reconstructed from stored CISA addition dates (additive only; removals are not tracked).
Historical or backfilled KEV records cannot be identified reliably from existing fields and are not listed as a separate category.
Prefer deep links to individual CVE reports and this methodology when citing sensor-observed vulnerabilities.
Early warning alerts
Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.
