Security Digest: July 14, 2026 - 16 Critical Vulnerabilities

Today’s advisory set is dominated by authentication bypasses, remote code execution, and data exposure flaws across enterprise platforms, CMS tools, and industrial software. Several issues are already exploitable with low effort, and multiple public exploit paths or known default/sample credentials raise the risk of rapid compromise.

· 12 min read

Urgent Security Digest: 16 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s advisory set is dominated by authentication bypasses, remote code execution, and data exposure flaws across enterprise platforms, CMS tools, and industrial software. Several issues are already exploitable with low effort, and multiple public exploit paths or known default/sample credentials raise the risk of rapid compromise.

Act now: patch exposed systems first, disable or restrict vulnerable services where possible, and verify no sample credentials, weak access controls, or untrusted archive/file upload paths remain in production.

Critical Vulnerabilities

CVE-2026-62422: JetBrains YouTrack authentication bypass via direct database access

  • Impact: Attackers with direct database access can bypass authentication and gain administrative access.
  • Affected Systems: JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429.
  • Immediate Action: Restrict database access immediately and upgrade to a fixed release.
  • Mitigation: Apply the vendor patch; review database network exposure and rotate privileged credentials.

CVE-2026-56451: Opcenter X JWT algorithm validation failure

  • Impact: Unauthenticated attackers can forge JWTs, impersonate users, and potentially take over admin accounts.
  • Affected Systems: Opcenter X versions V2604.
  • Immediate Action: Treat the application as compromised if exposed and block external access until patched.
  • Mitigation: Upgrade to V2604 or later; verify JWT validation settings and rotate signing material.

CVE-2026-27690: SAP Approuter HTTP request smuggling

  • Impact: Attackers can desynchronize requests, exposing user responses and disrupting service availability.
  • Affected Systems: SAP Approuter deployments.
  • Immediate Action: Patch urgently and place the service behind a trusted reverse proxy if possible.
  • Mitigation: Apply the SAP fix; monitor for anomalous request patterns and backend response leakage.

CVE-2026-44761: SAP Commerce Cloud sample OAuth2 client credentials exposure

  • Impact: Attackers can use public sample credentials to obtain access tokens and read or modify data.
  • Affected Systems: SAP Commerce Cloud systems that retained sample OAuth2 client configuration.
  • Immediate Action: Search for sample credentials now and remove them from all environments.
  • Mitigation: Replace with unique client credentials, revoke exposed tokens, and audit API access.

CVE-2026-3014: Milestone XProtect Management Server API RCE

  • Impact: Users with edit permissions can execute arbitrary code in the Management Server Service context.
  • Affected Systems: Milestone XProtect Management Server and related cumulative patch levels.
  • Immediate Action: Limit edit permissions immediately and apply the latest vendor update.
  • Mitigation: Patch to the fixed version; review privileged accounts and service permissions.

CVE-2026-57898: Eclipse BaSyx arbitrary file write via thumbnail API

  • Impact: Remote attackers can write files anywhere the Java process can access, with possible RCE.
  • Affected Systems: Eclipse BaSyx Java Server SDK 2.0.0-milestone-05 through 2.0.0-milestone-12 using the MongoDB backend.
  • Immediate Action: Disable exposed thumbnail upload paths or isolate the service until upgraded.
  • Mitigation: Upgrade to 2.0.0-milestone-13; verify filesystem permissions and uploaded file handling.

CVE-2026-15416: Argo CD repo-server remote code execution

  • Impact: Unauthenticated attackers with network access may achieve RCE and deploy malicious Kubernetes resources.
  • Affected Systems: Argo CD and Red Hat OpenShift GitOps deployments exposing repo-server.
  • Immediate Action: Restrict network access to repo-server immediately.
  • Mitigation: Patch Argo CD, review cluster roles, and inspect recently deployed manifests.

CVE-2026-57855: Cockpit CMS bucket API missing authorization

  • Impact: Any authenticated user can list, upload, rename, create folders, and remove files in any bucket.
  • Affected Systems: Cockpit CMS installations using /system/buckets/api.
  • Immediate Action: Restrict access to the bucket API and review all authenticated roles.
  • Mitigation: Apply a fix from the vendor or disable the feature until access checks are added.

CVE-2026-57856: Cockpit CMS path traversal in bucket API

  • Impact: Low-privileged users can traverse paths and access or delete files across buckets.
  • Affected Systems: Cockpit CMS installations using the Bucket file storage API.
  • Immediate Action: Block crafted bucket requests and audit for cross-bucket file access.
  • Mitigation: Patch immediately; validate path normalization and enforce strict bucket allowlists.

CVE-2026-44752: SAP NetWeaver JavaScript injection via crafted URLs

  • Impact: Attackers can run malicious JavaScript in victims’ browsers and steal session data.
  • Affected Systems: SAP NetWeaver Application Server Java.
  • Immediate Action: Warn users not to click untrusted links and patch internet-facing systems first.
  • Mitigation: Apply SAP remediation and review URL handling and output encoding.

CVE-2026-44745: SAP Approuter OAuth2 login flow header validation flaw

  • Impact: A malicious link can lead to unauthorized access after a victim clicks it.
  • Affected Systems: SAP Approuter under certain OAuth2 login configurations.
  • Immediate Action: Treat suspicious login links as hostile and patch quickly.
  • Mitigation: Update SAP Approuter and validate request headers at the edge.

CVE-2026-58233: SAP ctsattach insecure deserialization in archive processing

  • Impact: An authenticated attacker can trigger RCE by supplying a crafted archive.
  • Affected Systems: SAP Change and Transport System Attach Tool (ctsattach).
  • Immediate Action: Stop processing untrusted archives until patched.
  • Mitigation: Apply the SAP fix and restrict who can submit archives for processing.

CVE-2026-54429: SIMATIC S7-PLCSIM Advanced multicast denial of service

  • Impact: High-volume multicast traffic can exhaust memory and crash the application.
  • Affected Systems: SIMATIC S7-PLCSIM Advanced, all versions, with specific project configurations active.
  • Immediate Action: Segment the local network and limit multicast exposure.
  • Mitigation: Apply vendor guidance, restart affected instances, and monitor resource consumption.

CVE-2026-15676: code-projects Online Job Portal SQL injection in DeleteUser.php

  • Impact: Remote attackers can inject SQL; public exploit code is available.
  • Affected Systems: code-projects Online Job Portal up to 1.0.
  • Immediate Action: Take the portal offline if exposed and block public access now.
  • Mitigation: Patch or replace the application; review database accounts and logs for abuse.

CVE-2026-15677: code-projects Online Job Portal unrestricted file upload

  • Impact: Attackers can upload arbitrary files remotely, which may lead to code execution.
  • Affected Systems: code-projects Online Job Portal 1.0, /JobSeekerInsert.php.
  • Immediate Action: Disable file uploads immediately.
  • Mitigation: Enforce strict file type and content checks; patch or remove the vulnerable component.

CVE-2026-15675: code-projects Online Job Portal SQL injection in EditUser.php

  • Impact: Remote attackers can inject SQL and potentially extract or alter data.
  • Affected Systems: code-projects Online Job Portal 1.0.
  • Immediate Action: Restrict access to admin functions and inspect for compromise.
  • Mitigation: Patch immediately and validate all user-controlled database queries.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first, especially SAP, JetBrains, Argo CD, and any app with upload, login, or API exposure.
  2. Disable or restrict risky features: file uploads, bucket APIs, repo-server access, sample OAuth clients, and archive processing.
  3. Rotate credentials and tokens where authentication bypass or sample credentials may have been exposed.
  4. Review logs for abuse: suspicious JWTs, strange login redirects, odd bucket/file activity, SQL errors, and unexpected admin actions.
  5. Quarantine systems with public exploit paths until patched and verified.

Verification: confirm patched version numbers, check that exposed services are no longer reachable from untrusted networks, and validate that sample credentials and default configs are removed.

Monitoring: alert on new admin accounts, token issuance spikes, unusual file writes, request smuggling indicators, and unexpected Kubernetes resource changes.

Related Resources

  • Internal blog posts: pending publication for today’s top-priority CVEs.
  • Official vendor advisories: JetBrains, Siemens, SAP, Milestone, Eclipse BaSyx, Red Hat/OpenShift, and Cockpit CMS security notices.

Keep reading