grc-scanSecurity & governance
← Back to homethe latest briefing →
Patch tracker6 July 2026Archived edition

What to patch now

This edition was published on 6 July 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest briefing for the current picture.

The takeaway

Two brand-new entries this fortnight — Microsoft SharePoint and the SimpleHelp remote-support tool — both let an attacker log in without real credentials: one by smuggling malicious data past the server, the other by forging a login token outright. That's the recurring failure mode across this whole list: software trusting something it should have verified first, whether that's a data payload, a login token, or a file path. The fix is rarely exotic — it's the vendor's own patch, already published. Three cheap habits cover most of it: patch promptly (especially anything CISA flags), keep admin and remote-support interfaces off the public internet, and put MFA on remote access — backed by tested offline backups for when something slips through anyway.

What to patch now — 6 July 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, version 2026.07.01 — the most recently added entries. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

1. Microsoft SharePoint Server — malicious data triggers full code execution (CVE-2026-45659)

🛠️ Microsoft SharePoint Server · added 1 Jul 2026 · CISA fix-by date 4 Jul 2026

What it is: SharePoint unpacks ("deserializes") data it receives to make sense of it. A flaw here lets an attacker who's logged in disguise malicious instructions as ordinary data — once SharePoint unpacks it, those instructions run as code on the server, handing over control.

Who's affected: Businesses running on-premises SharePoint Server to store and share documents internally or with partners. (This does not affect cloud SharePoint Online inside Microsoft 365 — that's patched centrally by Microsoft.)

What to do: Apply Microsoft's security update immediately — CISA gave this an unusually short window, a sign it's being actively exploited. If an IT provider manages your SharePoint, ask them to confirm it's done today, not "on the list."

2. SimpleHelp remote-support software — forged login lets attackers in with no password (CVE-2026-48558)

🛠️ SimpleHelp · added 29 Jun 2026 · CISA fix-by date 2 Jul 2026

What it is: SimpleHelp is remote-support software IT staff use to reach into a computer and fix problems. When it's set up to log in via "OIDC" (a common single-sign-on standard), it fails to check that a login token is genuine — so an attacker can forge one and be granted a fully logged-in technician session, in some setups even skipping multi-factor authentication (MFA).

Who's affected: Anyone using SimpleHelp for remote support, configured with single-sign-on login — this is common among the outsourced IT firms (MSPs) many small businesses rely on, since one compromised SimpleHelp instance can reach every client they support.

What to do: If you or your IT provider run SimpleHelp, apply the vendor's security update now. Because this is the kind of tool an MSP uses to touch many customers at once, ask your provider directly and in writing whether it's patched.

3. PTC Windchill / FlexPLM remote code execution (CVE-2026-12569)

🛠️ PTC Windchill and FlexPLM · added 25 Jun 2026 · CISA fix-by date 28 Jun 2026

What it is: A single malicious network request can run attacker-chosen code on the server — no login required.

Who's affected: Manufacturers and product/engineering teams using PTC Windchill (product lifecycle management) or FlexPLM. Mostly larger or industrial suppliers — relevant if one of yours holds your designs or specs.

What to do: Apply PTC's fix. If a supplier runs this, it's a fair question to ask whether they've patched, since your data may sit inside it.

4. Cisco phone-system server can be tricked into running as root (CVE-2026-20230)

🛠️ Cisco Unified Communications Manager · added 25 Jun 2026 · CISA fix-by date 28 Jun 2026

What it is: A flaw lets an attacker on the internet, with no login, make the server fetch and write files it shouldn't — a foothold they can later turn into full "root" (total) control of the machine.

Who's affected: Businesses running Cisco's Unified Communications Manager (Unified CM) — the system behind many office phone/VoIP setups, including the Session Management Edition.

What to do: Apply Cisco's update for this advisory now. If your phones are managed by an IT provider or reseller, forward this and ask them to confirm the patch is on. Don't expose the management interface to the open internet.

5. Ubiquiti UniFi network gear — three actively-exploited flaws (CVE-2026-34908, -34909, -34910)

🛠️ Ubiquiti UniFi OS · added 23 Jun 2026 · CISA fix-by date 26 Jun 2026

What it is: Three separate weaknesses in UniFi OS that an attacker already on your network can chain together: command injection (run commands on the device), path traversal (read files they shouldn't), and improper access control (make unauthorised changes).

Who's affected: Anyone using Ubiquiti UniFi routers, switches, access points or the UniFi controller — very common in small offices, cafés, and shops because it's affordable prosumer kit.

What to do: Open your UniFi console and install the latest UniFi OS / firmware update. Make sure the management console isn't reachable from the public internet, and that the admin account uses a strong, unique password.

6. Lantronix EDS5000 device server — command injection as root (CVE-2025-67038)

🛠️ Lantronix EDS5000 · added 23 Jun 2026 · CISA fix-by date 26 Jun 2026

What it is: An attacker can smuggle operating-system commands through the login username field; those commands run with the highest "root" privilege.

Who's affected: Sites using Lantronix EDS5000 device/serial servers — typically industrial, building-management or point-of-sale equipment that connects older serial devices to the network.

What to do: Apply the vendor firmware update. These boxes are often forgotten — if you have one, make sure it isn't directly exposed to the internet and is on a separate part of the network.

7. Splunk Enterprise — unauthenticated file tampering (CVE-2026-20253)

🛠️ Splunk Enterprise · added 18 Jun 2026 · CISA fix-by date 21 Jun 2026

What it is: A missing authentication check lets an attacker with no login create or wipe files on the server through a side service, which can corrupt the system or destroy logs.

Who's affected: Organisations running Splunk Enterprise for log management / security monitoring. More of a mid-size-and-up tool, but if you outsource monitoring to an MSP, they may use it.

What to do: Upgrade to Splunk's patched version. If a security provider runs Splunk on your behalf, ask them to confirm it's done — ironically, the tool that watches for attacks is the target here.

8. Joomla "Content Editor" plugin — anyone can upload and run code (CVE-2026-48907)

🛠️ Widget Factory Joomla Content Editor (JCE) · added 16 Jun 2026 · CISA fix-by date 19 Jun 2026

What it is: A flaw lets an unauthenticated visitor create an editor profile and upload PHP code, then run it — effectively handing them the website.

Who's affected: Websites built on Joomla that use the popular JCE (Joomla Content Editor) extension.

What to do: Update the JCE extension to the latest version immediately, and remove it if you don't use it. As with WordPress, out-of-date CMS plugins are one of the most common ways small-business sites get hijacked.

9. LiteSpeed cPanel plugin — shared-hosting symlink flaw (CVE-2026-54420)

🛠️ LiteSpeed cPanel Plugin · added 15 Jun 2026 · CISA fix-by date 18 Jun 2026

What it is: On shared hosting, an attacker who already has limited access (e.g. FTP or a web shell on one account) can abuse symbolic links to reach files belonging to other customers on the same server.

Who's affected: This is primarily a hosting-provider issue — shared servers running CloudLinux/CageFS with the LiteSpeed cPanel plugin. As a small-business site owner you can't patch it, but you can ask your host.

What to do: If your website is on shared hosting, ask your provider whether they run LiteSpeed on cPanel and have applied this fix. It's a reasonable, specific question that tells you how on-top-of-things your host is.

10. Cisco Catalyst SD-WAN Manager — file overwrite (CVE-2026-20262)

🛠️ Cisco Catalyst SD-WAN Manager · added 15 Jun 2026 · CISA fix-by date 29 Jun 2026

What it is: A logged-in attacker can use a path-traversal flaw to create or overwrite any file on the system — a path to disrupting or taking over the network controller.

Who's affected: Organisations using Cisco Catalyst SD-WAN Manager to run multi-site networks. More common in larger or multi-branch businesses.

What to do: Apply Cisco's update. Restrict who can log in to the SD-WAN manager and keep its interface off the public internet.

11. 🔴 Oracle PeopleSoft — unauthenticated takeover, used in ransomware (CVE-2026-35273)

🛠️ Oracle PeopleSoft Enterprise PeopleTools · added 12 Jun 2026 · CISA fix-by date 15 Jun 2026

🔴 Ransomware-linked: CISA records this vulnerability as used in known ransomware campaigns — patching it is doubly urgent.

What it is: A missing authentication check lets an attacker with no credentials take over a PeopleSoft system outright.

Who's affected: Organisations running Oracle PeopleSoft (HR, finance, student records) — universities, larger employers, the public sector. If a supplier holds your data in PeopleSoft, it's in scope too.

What to do: Apply Oracle's June Critical Patch Update without delay. Because this is tied to active ransomware, also check that you have tested, offline backups and MFA on remote access.

12. Ivanti Sentry — remote root takeover (CVE-2026-10520)

🛠️ Ivanti Sentry (formerly MobileIron Sentry) · added 11 Jun 2026 · CISA fix-by date 14 Jun 2026

What it is: An unauthenticated attacker on the internet can inject operating-system commands and gain full root control — but only where the Sentry appliance is internet-facing and unmanaged.

Who's affected: Organisations using Ivanti Sentry to broker mobile-device access to email and internal apps. Exposure is worst when the appliance sits directly on the internet without the recommended mTLS/managed setup.

What to do: Apply Ivanti's patch. Confirm the appliance isn't directly exposed, and follow Ivanti's guidance on managed mode / mTLS, which closes off external access to the vulnerable interface.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.