Critical CVE Live Watch for July 27, 2026: Exploited and High-Risk Vulnerabilities

CVE-2026-55255: Langflow cross-user flow authorization bypass

NIST NVD and CISA KEV | July 7, 2026 | Known Exploited | CVSS 8.4 | Langflow Langflow before 1.9.1

Source summary: Before version 1.9.1, an authenticated attacker could specify another user's flow ID and execute that flow. The CNA rates the…

CISA lists this issue in the Known Exploited Vulnerabilities catalog, which makes confirmed exploitation the leading prioritization signal. Review the catalog due date and required action, then identify exposed assets before normal severity-only backlog work.

CISA due date: 2026-07-10. Apply the current Langflow fix and follow CISA KEV remediation guidance.

Critical CVE review: Check internet-facing and administrative instances first, then confirm the fixed version from the vendor.

Read the current source record

CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability

CISA Known Exploited Vulnerabilities | July 22, 2026 | Known Exploited | Check Point SmartConsole

Source summary: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login…

CISA lists this issue in the Known Exploited Vulnerabilities catalog, which makes confirmed exploitation the leading prioritization signal. Review the catalog due date and required action, then identify exposed assets before normal severity-only backlog work.

CISA due date: 2026-07-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Critical CVE review: Map the affected product to asset owners and set a validation deadline before closing remediation.

Read the current source record

CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerabilities | July 22, 2026 | Known Exploited | Microsoft SharePoint

Source summary: Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a…

CISA lists this issue in the Known Exploited Vulnerabilities catalog, which makes confirmed exploitation the leading prioritization signal. Review the catalog due date and required action, then identify exposed assets before normal severity-only backlog work.

CISA due date: 2026-07-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Critical CVE review: Look for exploitation indicators while patching, especially where the service was publicly reachable.

Read the current source record

CVE-2026-60137: WordPress Core SQL Injection Vulnerability

CISA Known Exploited Vulnerabilities | July 21, 2026 | Known Exploited | WordPress Core

Source summary: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability…

CISA lists this issue in the Known Exploited Vulnerabilities catalog, which makes confirmed exploitation the leading prioritization signal. Review the catalog due date and required action, then identify exposed assets before normal severity-only backlog work.

CISA due date: 2026-08-04. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Critical CVE review: Check internet-facing and administrative instances first, then confirm the fixed version from the vendor.

Read the current source record

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Source summary: Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

This record is a current vulnerability or package advisory. Confirm the affected version range and vendor fix before deployment, then prioritize instances that are public, privileged, or connected to sensitive data and production workflows.