Security Digest: July 21, 2026 - 8 Critical Vulnerabilities

Today’s alerts are dominated by publicly disclosed, remotely exploitable upload flaws in D-Link DNS-320 NAS devices, plus high-risk issues in Zyxel, WordPress, and Zoho products. The immediate priority is to remove exposed devices from the internet, patch affected systems, and assume compromise where public exploits exist.

· 8 min read

July 21, 2026: 8 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s alerts are dominated by publicly disclosed, remotely exploitable upload flaws in D-Link DNS-320 NAS devices, plus high-risk issues in Zyxel, WordPress, and Zoho products. The immediate priority is to remove exposed devices from the internet, patch affected systems, and assume compromise where public exploits exist.

Security teams should treat these findings as urgent: several issues allow attackers to upload files or bypass authentication, which can quickly lead to full device takeover, data theft, or malware deployment.

Critical Vulnerabilities

CVE-2026-16331: D-Link DNS-320 unrestricted upload via /web/function/save_ajax.php

Impact: Remote attackers can upload arbitrary files, creating a fast path to webshells, data theft, or device compromise.

Affected Systems: D-Link DNS-320 firmware 1.0.2.

Immediate Action: Take the NAS off the public internet now. Restrict access to trusted internal networks only and review for unexpected files or recent uploads.

Mitigation: Apply vendor remediation if available; otherwise disable external access, rotate credentials, and rebuild the device if exposure is confirmed.

CVE-2026-16329: D-Link DNS-320 unrestricted upload via /photo_center/php/uploadify.php

Impact: Attackers can remotely upload malicious content and potentially gain persistent access.

Affected Systems: D-Link DNS-320 firmware 1.0.2.

Immediate Action: Block WAN access immediately and check logs for upload activity to the photo center component.

Mitigation: Patch or isolate the device; if patching is unavailable, treat the NAS as high risk and replace it if internet exposure cannot be eliminated.

CVE-2026-16330: D-Link DNS-320 unrestricted upload via /web/jquery/uploader/uploadify.php

Impact: Public exploit availability increases the chance of opportunistic compromise and malware staging.

Affected Systems: D-Link DNS-320 firmware 1.0.2.

Immediate Action: Disable remote management and scan for unauthorized files in web-accessible directories.

Mitigation: Apply updates as soon as they are released; until then, segment the device and deny internet-facing access.

CVE-2026-16332: D-Link DNS-320 unrestricted upload via /mydlink/multi_uploadify.php

Impact: Remote attackers can upload malicious files that may lead to code execution or device abuse.

Affected Systems: D-Link DNS-320 firmware 1.0.2.

Immediate Action: Remove any port forwards or firewall rules exposing the NAS and look for suspicious upload artifacts.

Mitigation: Apply vendor fixes when available; otherwise disable the affected service and isolate the appliance.

CVE-2026-16327: D-Link DNS-320 unrestricted upload via /web/web_file/upload.php

Impact: Attackers can remotely place arbitrary files on the device, likely enabling takeover.

Affected Systems: D-Link DNS-320 firmware 1.0.2.

Immediate Action: Treat all internet-exposed DNS-320 units as urgent incident candidates and inspect for webshells or unknown scripts.

Mitigation: Restrict access immediately and replace unsupported hardware if remediation is not available.

CVE-2026-6952: Zyxel AX7501-B1 command injection in LogServer

Impact: An authenticated administrator can execute OS commands on the router, potentially leading to full device compromise.

Affected Systems: Zyxel AX7501-B1 firmware through 5.17(ABPC.7.2)C0.

Immediate Action: Limit admin access to trusted IPs, review admin accounts, and disable unnecessary remote administration.

Mitigation: Upgrade to a fixed firmware version as soon as Zyxel provides it; reset credentials and review configuration integrity after patching.

CVE-2026-1771: MapSVG arbitrary file upload in WordPress

Impact: Administrators can be tricked or abused into uploading arbitrary files, which may enable remote code execution.

Affected Systems: MapSVG plugin for WordPress all versions up to and including 8.14.0.

Immediate Action: Disable or remove MapSVG on production sites until patched and audit recent admin activity.

Mitigation: Update to a fixed version immediately; if unavailable, uninstall the plugin and inspect the server for unexpected PHP files.

CVE-2026-3183: Zoho ManageEngine ADSelfService Plus MFA bypass

Impact: Attackers may bypass multi-factor authentication, undermining a core account protection control.

Affected Systems: ManageEngine ADSelfService Plus versions before 6524.

Immediate Action: Prioritize patching and review authentication logs for suspicious successful logins without expected MFA prompts.

Mitigation: Upgrade to build 6524 or later and reset access for any accounts with suspicious authentication history.

Previously Alerted

What to Do Now

  1. Prioritize exposed internet-facing systems first — especially D-Link DNS-320 devices and any public admin portals.
  2. Patch or remove vulnerable software immediately — update ManageEngine ADSelfService Plus to 6524+, patch MapSVG, and apply Zyxel firmware fixes when available.
  3. Disable remote administration and port forwarding for NAS and router devices until remediation is complete.
  4. Assume compromise is possible where public exploit code exists; check for unknown files, new admin accounts, and suspicious logins.
  5. Rotate credentials for affected systems and any accounts that could be used to reach them.

Verification steps: confirm firmware and plugin versions, inventory all exposed instances, and validate that no affected service remains reachable from the internet. Review web server and device logs for recent uploads, unusual authentication attempts, and changes to configuration.

Monitoring recommendations: alert on new files in web-accessible directories, unexpected admin logins, outbound connections from NAS/router devices, and any process spawning from web services or management interfaces.

Related Resources

  • Internal blog post: “How to Respond to Publicly Exploited Upload Flaws” — coming soon.
  • Internal blog post: “Hardening NAS and Router Appliances Against Remote Takeover” — coming soon.
  • Official vendor advisories: D-Link, Zyxel, WordPress/MapSVG, and Zoho ManageEngine security advisories.

Keep reading