Security Digest: July 12, 2026 - 6 Critical Vulnerabilities

Today’s advisory set is dominated by six high-severity flaws with public exploits or active proof-of-concepts, including SQL injection, unrestricted file upload, and missing authentication issues. The most urgent actions are to identify exposed systems, restrict access immediately, and patch or isolate vulnerable services now before attackers begin broad scanning.

· 8 min read

Urgent July 12 Alert: Six Publicly Exploitable Vulnerabilities Demand Immediate Action

Executive Summary

Today’s advisory set is dominated by six high-severity flaws with public exploits or active proof-of-concepts, including SQL injection, unrestricted file upload, and missing authentication issues. The most urgent actions are to identify exposed systems, restrict access immediately, and patch or isolate vulnerable services now before attackers begin broad scanning.

Critical Vulnerabilities

CVE-2026-15479: H3C NX15 Administrator Password Modification Weakness

  • Impact: Remote attackers may abuse password recovery logic to weaken or bypass password controls on the administrator password modification endpoint.
  • Affected Systems: H3C NX15 V100R017, endpoint /api/login/modify in the Administrator Password Modification component.
  • Immediate Action: Remove internet exposure if possible, restrict access to trusted admin networks, and force credential review for all administrative accounts.
  • Mitigation: Apply vendor guidance as soon as available; until then, enforce MFA, rotate privileged passwords, and monitor for unauthorized password reset activity.

CVE-2026-15482: Aster Telecom Azcall SQL Injection in HTTP Handler

  • Impact: Remote attackers can inject SQL via request parameters and potentially read, modify, or destroy backend data.
  • Affected Systems: Aster Telecom Azcall 10/11, endpoint /azcall/adm/gestao_loja/sis.php?t=consultar.
  • Immediate Action: Treat this as exposed until proven otherwise; block external access to the affected path and review database and application logs for suspicious queries.
  • Mitigation: Apply any vendor fix immediately; if no patch exists, disable the vulnerable function, add WAF rules for SQL injection patterns, and rotate database credentials.

CVE-2026-15488: shiroiAdmin Unrestricted File Upload

  • Impact: Attackers can upload malicious files remotely, creating a path to web shell deployment and full server compromise.
  • Affected Systems: hcr707305003 shiroiAdmin 1.1 and 1.3, file app/common/controller/FileController.php.
  • Immediate Action: Disable file upload features if possible, isolate the application, and inspect upload directories for unexpected scripts or executables.
  • Mitigation: Upgrade to version 1.4 or apply patch 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70 immediately; enforce strict file type validation and storage outside the web root.

CVE-2026-15491: TOKO-ONLINE-ROTI Missing Authentication

  • Impact: Remote attackers may reach functions without logging in, potentially exposing sensitive operations and data.
  • Affected Systems: RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99.
  • Immediate Action: Assume unauthorized access is possible; place the application behind access controls and verify that sensitive endpoints require authentication.
  • Mitigation: Apply the vendor fix when available; until then, restrict network exposure, add reverse-proxy authentication, and audit for unauthorized transactions or account access.

CVE-2026-15489: TOKO-ONLINE-ROTI SQL Injection in login.php

  • Impact: Remote attackers can inject SQL through the Username parameter and potentially extract or alter customer and order data.
  • Affected Systems: RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99, file proses/login.php.
  • Immediate Action: Monitor login traffic for odd payloads, block suspicious requests at the edge, and review authentication logs for abuse.
  • Mitigation: Patch as soon as a fixed build is available; use parameterized queries, WAF rules, and database credential rotation if compromise is suspected.

CVE-2026-15490: TOKO-ONLINE-ROTI SQL Injection in add.php

  • Impact: Remote attackers can inject SQL via product/customer fields and may gain unauthorized access to backend data or functions.
  • Affected Systems: RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99, file proses/add.php.
  • Immediate Action: Disable or restrict the affected workflow, inspect application and database logs, and look for unusual insert or update activity.
  • Mitigation: Apply the vendor fix when released; until then, add input validation, parameterized database access, WAF protections, and privilege reduction for the application account.

What to Do Now

  1. Prioritize internet-facing systems first. If any of these products are exposed externally, move them behind VPN, IP allowlists, or temporary access controls immediately.
  2. Patch or isolate today. Apply the shiroiAdmin update now and follow vendor guidance for the other products as soon as it is released.
  3. Assume exploitation attempts are already underway. Public exploit availability means scanning and opportunistic attacks will be fast.
  4. Verify exposure. Search your asset inventory for H3C NX15 V100R017, Azcall 10/11, shiroiAdmin 1.1/1.3, and TOKO-ONLINE-ROTI instances up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99.
  5. Hunt for indicators. Review web logs for SQL injection patterns, file uploads with script extensions, repeated password modification requests, and unauthenticated access to sensitive endpoints.

Verification and Monitoring

  • Verification: Confirm patched versions, disable vulnerable endpoints, and test that authentication and authorization are enforced on all admin functions.
  • Monitoring: Alert on spikes in 4xx/5xx responses, new files in upload directories, database errors, unexpected admin password resets, and outbound connections from web servers.
  • Containment: If compromise is suspected, isolate the host, preserve logs, rotate credentials, and review database integrity before restoring service.

Related Resources

  • Internal: Refer to the upcoming internal blog post on emergency triage for public-exploit CVEs.
  • Official vendor advisories: Monitor H3C, Aster Telecom, and RafyMrX release channels for patch notices and mitigation updates.

Keep reading