This week's list has a theme sitting right in the numbering: entry #2 is SharePoint's third confirmed actively-exploited flaw in three weeks, and it's a completely separate bug from the two before it — patching the first two does nothing for this one. That's the trap with software patching in general: "we patched SharePoint last week" feels like a closed task, but each new vulnerability needs its own fix applied, even on the same product, even in the same month. The other entries make a related point from a different angle — a mainstream platform everyone assumes is well looked after (WordPress), a security console meant to be protecting you (Check Point), and two lower-profile tools installed by a developer or a technical employee rather than through your normal IT process (Langflow, DD-WRT) can all carry live, actively-exploited bugs at the very same time. If your instinct on hearing "we're patched" is to stop asking questions, that's the exact assumption this list argues against — ask what specifically was patched, and when, every time, not just once.

What to patch now — 27 July 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

1. Check Point SmartConsole — attackers get full admin login tokens with no password (CVE-2026-16232)

🛠️ Check Point SmartConsole · added 22 Jul 2026 · CISA fix-by date 25 Jul 2026

What it is: "Improper authentication" is the jargon — it means the system doesn't correctly verify who's asking before handing something sensitive over. Here, SmartConsole (the management console admins use to configure Check Point security devices) can be tricked into handing out valid login tokens to an attacker who never logged in — and those tokens carry full administrator rights.

Who's affected: Businesses (or their IT/security provider) that manage Check Point firewalls or other security appliances through SmartConsole — the very tool meant to configure and protect your network perimeter.

What to do: Apply Check Point's fix immediately — CISA gave this only a 3-day window, a sign of how serious it is. If a security provider manages your Check Point kit, ask them today whether it's patched; a compromised management console can mean a compromised firewall.

2. Microsoft SharePoint — a third serious flaw in as many weeks (CVE-2026-50522)

🛠️ Microsoft SharePoint · added 22 Jul 2026 · CISA fix-by date 25 Jul 2026

What it is: The same "deserialization" flaw type flagged in SharePoint last week — the software unpacks crafted data as if it were legitimate content, but it's actually instructions, which then run as code on the server. This is a separate bug from the two covered previously; patching those does not cover this one.

Who's affected: Businesses running an on-premises SharePoint Server — the same audience as before. Cloud "SharePoint Online" inside Microsoft 365 is patched centrally by Microsoft and isn't affected.

What to do: If you haven't already applied Microsoft's last two rounds of SharePoint updates, this is now the third fix in a row — treat SharePoint as this week's top priority, not a "get to it eventually" item. Ask whoever manages your SharePoint server to confirm all three fixes are in place, not just the newest one.

3–4. WordPress Core — two flaws that chain into a takeover with no login needed (CVE-2026-60137, CVE-2026-63030)

🛠️ WordPress Core · added 21 Jul 2026 · CISA fix-by dates 24 Jul / 4 Aug 2026

What it is: "SQL injection" means an attacker sneaks database commands into a form field or web-address parameter the site wasn't expecting, tricking the database into running them. The second flaw, an "interpretation conflict," is a separate quirk that lets that injected command be read differently by WordPress than intended — and CISA confirms the two can be chained together into full remote code execution, without ever logging in.

Who's affected: Any business running a self-hosted WordPress website — a huge share of small-business sites, whether it's the main site, a blog, or a customer-facing shop.

What to do: Update to WordPress 7.0.2 or later now — this patches both flaws. If a web designer or agency manages your site, ask them to confirm the update is live; many hosts apply WordPress core updates automatically, but it's worth checking rather than assuming.

5. Langflow — a flaw in a popular AI workflow-builder lets outsiders run their own code (CVE-2026-0770)

🛠️ Langflow · added 21 Jul 2026 · CISA fix-by date 24 Jul 2026

What it is: "Inclusion of functionality from an untrusted control sphere" is the formal way of saying the software will load and run functionality handed to it from a source it shouldn't trust — in effect, letting an outsider supply code that then executes as if it were part of the trusted application.

Who's affected: Businesses that have set up their own Langflow instance to build internal AI chatbots or automation workflows — increasingly common as small businesses experiment with in-house AI tools, usually self-hosted on a cloud server by a developer or a technical staff member rather than rolled out by a formal IT department.

What to do: Update to Langflow 1.9.0 or later. If someone on your team, or a contractor, set up an AI tool using Langflow, check with them directly — this is exactly the kind of fast-moving, developer-installed tool that doesn't get automatic updates the way mainstream business software does.

6. DD-WRT router firmware — a 15-year-old bug just confirmed under attack (CVE-2021-27137)

🛠️ DD-WRT · added 21 Jul 2026 · CISA fix-by date 24 Jul 2026

What it is: A "stack-based buffer overflow" happens when a program tries to cram more data into a fixed-size piece of memory than it was built to hold, spilling into space it doesn't own — which an attacker can exploit to make the device run their own code instead of its own. This one sits in UPnP, the feature that lets devices on your network automatically open ports for themselves (used by some game consoles, smart-home gear, and video-calling apps).

Who's affected: Businesses or tech-savvy owners running DD-WRT, a free, open-source alternative firmware some people install on their own router in place of the manufacturer's software — more common on older or budget hardware repurposed to add features it didn't originally have.

What to do: Update to a DD-WRT build that includes this fix. If you're not sure whether your router runs DD-WRT, check its admin page (often at an address like 192.168.1.1) for the firmware name. As an immediate mitigation either way, turning off UPnP in your router settings closes this specific door — most small businesses don't need it switched on.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.

What to patch now