Wednesday, July 29, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Apache Software Foundation products account for the heaviest critical exposure in yesterday's disclosures, with three separate CVSS 10 flaws in Apache Traffic Server alongside CVSS 9.8 issues in Axis2/Java and Syncope. The day brought 23 critical vulnerabilities (down 23% from 30) and 58 high-priority CVEs (down 36% from 91), with 2 entries carrying confirmed active exploitation. Notable critical items include CVE-2026-33267, CVE-2026-57834 and CVE-2026-58150 in Apache Traffic Server (all CVSS 10), CVE-2026-66713 in Apache Axis2/Java (CVSS 9.8), and CVE-2026-63227 in Koollab LMS (CVSS 9.9). WordPress and Joomla extensions make up a large share of the remainder, including Advanced Responsive Video Embedder, TrueBooker, and the Balbooa Forms component at CVSS 9.8 to 10, a pattern that puts unmanaged CMS installations at the highest practical risk. Patch availability data is not yet recorded for these disclosures (0%), so treat vendor advisories as the authoritative source and prioritize compensating controls where fixes are pending.

  • Apache Traffic Server carries three CVSS 10 vulnerabilities (CVE-2026-33267, CVE-2026-57834, CVE-2026-58150), with additional CVSS 9.8 flaws in Apache Axis2/Java and Apache Syncope
  • 23 critical vulnerabilities (CVSS 9.0+), down 23% from 30 the prior day
  • 58 high-priority vulnerabilities (CVSS 7.0-8.9), down 36% from 91 the prior day
  • Remote code execution and authentication bypass dominate the critical set, spanning proxy infrastructure (Traffic Server), Java middleware (Axis2, Syncope), and CMS extensions (Advanced Responsive Video Embedder, TrueBooker, Balbooa Forms)
  • Patch availability is recorded at 0% for this batch, so verify fixed versions directly with each vendor before scheduling remediation
  • 2 vulnerabilities show confirmed exploitation in the wild: CVE-2026-16812 in Arista VeloCloud Orchestrator On-Prem (CVSS 10) and CVE-2025-68686 in Fortinet FortiOS (CVSS 9.5)

Immediate action: Prioritize internet-facing Apache Traffic Server deployments and Apache Axis2/Java or Syncope instances, then sweep WordPress and Joomla sites for the affected plugins and components (Advanced Responsive Video Embedder, TrueBooker, Balbooa Forms). Arista VeloCloud Orchestrator On-Prem and Fortinet FortiOS should be treated as immediate given confirmed exploitation. Patch availability is unconfirmed for this batch, so check vendor advisories for fixed builds and apply access restrictions or WAF rules on exposed services until updates are validated.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation