grc-scanSecurity & governance
← Back to homethe latest briefing →
Patch tracker13 July 2026Archived edition

What to patch now

This edition was published on 13 July 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest briefing for the current picture.

The takeaway

Five of this fortnight's twelve entries are the exact same mistake — an unauthenticated visitor uploading a disguised file that the server then runs — landing in four different Joomla plugins (Balbooa Forms, iCagenda, SP Page Builder, Joomlack Page Builder) within days of each other. That's not a coincidence; it's what happens when attackers find one weakness pattern works and then systematically probe every plugin that might share it. If your website runs on a content-management system like Joomla or WordPress, every extension you've installed is a separate door with its own lock, and a "no login required" flaw is the most dangerous kind because it doesn't even need a stolen password to walk through. The practical response is unglamorous but effective: keep every plugin and extension updated, not just the core CMS; delete ones you no longer use instead of leaving them dormant; and if you don't know what's installed on your site, ask whoever built or hosts it for a list — you can't patch what you don't know is there.

What to patch now — 13 July 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, version 2026.07.10 — the most recently added entries. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

1. Balbooa Forms (Joomla) — booby-trapped file upload gives full control (CVE-2026-56291)

🛠️ Balbooa Forms · added 10 Jul 2026 · CISA fix-by date 13 Jul 2026

What it is: "Unrestricted file upload" is the jargon — it means the form-builder doesn't check what kind of file it's being sent. An attacker submits a file disguised as an image or document that's actually a small program; the server runs it, and the attacker now controls the site.

Who's affected: Small-business websites built on Joomla that use the Balbooa Forms extension for contact forms, quote requests, or bookings.

What to do: Update the Balbooa Forms extension today. If you don't recognise an attached file from a form submission, don't open it — check with your web developer or host. Remove the extension if you're not using it.

2. iCagenda — the event-booking calendar's attachment box can run code (CVE-2026-48939)

🛠️ iCagenda · added 10 Jul 2026 · CISA fix-by date 13 Jul 2026

What it is: iCagenda's event-booking calendar lets a visitor attach a file when registering for an event. It doesn't check what kind of file that is, so an attacker can attach a bit of disguised code and get the site to run it.

Who's affected: Joomla sites using iCagenda to run events, classes, or bookings — clubs, venues, community groups, training providers.

What to do: Update iCagenda via the vendor's download page now. Remove it if you no longer use it for bookings.

3. JoomShaper SP Page Builder — no login needed to take over the whole site (CVE-2026-48908)

🛠️ JoomShaper SP Page Builder · added 7 Jul 2026 · CISA fix-by date 10 Jul 2026

What it is: SP Page Builder is a drag-and-drop tool many Joomla sites use to design entire pages. This flaw lets anyone on the internet — no account required — upload and run a file of their choosing, handing them the whole website, not just a form.

Who's affected: Any small-business Joomla site built with SP Page Builder — a widely used extension, so this reaches a lot of ordinary business websites.

What to do: Update SP Page Builder immediately. No login is needed to exploit this one, so treat it as more urgent than a routine patch.

4. Langflow — one user can run another user's AI workflow (CVE-2026-55255)

🛠️ Langflow · added 7 Jul 2026 · CISA fix-by date 10 Jul 2026

What it is: Langflow is a visual tool for building AI "flows" — chains of steps an AI agent follows, often holding connected accounts or business data. Each flow is meant to stay private to the person who built it, but a flaw lets a logged-in attacker simply specify someone else's flow ID in a request and run it as if it were their own.

Who's affected: Any business trialling AI automation on a shared, multi-user Langflow install — increasingly common as small businesses experiment with AI agents for support, sales, or internal admin.

What to do: Apply the vendor's fix now. Until then, treat any Langflow instance with more than one user account as exposed — don't store customer data or credentials inside a flow's settings.

5. Joomlack Page Builder — same file-upload flaw, different Joomla plugin (CVE-2026-56290)

🛠️ Joomlack Page Builder · added 7 Jul 2026 · CISA fix-by date 10 Jul 2026

What it is: The same failure as the Joomla extensions above — a visitor with no account can upload and run a file, taking control of the site.

Who's affected: Joomla sites using the Joomlack Page Builder extension to lay out pages.

What to do: Update immediately, or remove the extension if it's not in active use. If an agency or freelancer built your site, ask them directly whether this extension is installed.

6. Adobe ColdFusion — a file-path trick leads to code execution (CVE-2026-48282)

🛠️ Adobe ColdFusion · added 7 Jul 2026 · CISA fix-by date 10 Jul 2026

What it is: "Path traversal" means an attacker tricks the server into opening files outside the folder it should be confined to (walking the file system with something like "../../"). Here, that trick goes further and lets the attacker get their own code to run.

Who's affected: Businesses running Adobe ColdFusion as the engine behind an older or custom-built website or internal tool — often set up by a developer or agency years ago and since forgotten about.

What to do: Apply Adobe's patch (security bulletin APSB26-68) now. If you're not sure whether your site runs ColdFusion, ask whoever built or hosts it.

7. Microsoft SharePoint Server — malicious data triggers full code execution (CVE-2026-45659)

🛠️ Microsoft SharePoint Server · added 1 Jul 2026 · CISA fix-by date 4 Jul 2026

What it is: SharePoint unpacks ("deserializes") data it receives to make sense of it. A flaw here lets an attacker who's logged in disguise malicious instructions as ordinary data — once SharePoint unpacks it, those instructions run as code on the server.

Who's affected: Businesses running on-premises SharePoint Server to store and share documents internally or with partners. (Cloud SharePoint Online inside Microsoft 365 is patched centrally by Microsoft and isn't affected.)

What to do: If you haven't already, apply Microsoft's security update now. If an IT provider manages your SharePoint, get written confirmation it's done.

8. SimpleHelp remote-support software — a forged login skips the password (CVE-2026-48558)

🛠️ SimpleHelp · added 29 Jun 2026 · CISA fix-by date 2 Jul 2026

What it is: SimpleHelp is remote-support software IT staff use to reach into a computer and fix problems. When set up to log in via "OIDC" (a common single-sign-on standard), it fails to check that a login token is genuine — letting an attacker forge one and be granted a fully logged-in technician session, in some setups even skipping multi-factor authentication (MFA).

Who's affected: Anyone using SimpleHelp for remote support with single-sign-on login enabled — common among the outsourced IT firms (MSPs) many small businesses rely on, since one compromised instance can reach every client they support.

What to do: If you or your IT provider run SimpleHelp, confirm the vendor's security update is applied — and ask in writing, since a compromise here can touch many customers at once.

9. PTC Windchill / FlexPLM — no login needed for remote code execution (CVE-2026-12569)

🛠️ PTC Windchill and FlexPLM · added 25 Jun 2026 · CISA fix-by date 28 Jun 2026

What it is: A single malicious network request can run attacker-chosen code on the server — no login required.

Who's affected: Manufacturers and product/engineering teams using PTC Windchill (product lifecycle management) or FlexPLM. Mostly larger or industrial suppliers — relevant if one of yours holds your designs or specs.

What to do: Apply PTC's fix. If a supplier runs this, it's a fair question to ask whether they've patched, since your data may sit inside it.

10. Cisco phone-system server can be tricked into writing files as root (CVE-2026-20230)

🛠️ Cisco Unified Communications Manager · added 25 Jun 2026 · CISA fix-by date 28 Jun 2026

What it is: A flaw lets an attacker on the internet, with no login, make the server fetch and write files it shouldn't — a foothold that can later be turned into full "root" (total) control of the machine.

Who's affected: Businesses running Cisco's Unified Communications Manager (Unified CM) — the system behind many office phone/VoIP setups, including the Session Management Edition.

What to do: Apply Cisco's update. Don't expose the management interface to the open internet, and ask any managed-phone provider to confirm the patch is in.

11. Lantronix EDS5000 device server — command injection as root (CVE-2025-67038)

🛠️ Lantronix EDS5000 · added 23 Jun 2026 · CISA fix-by date 26 Jun 2026

What it is: An attacker can smuggle operating-system commands through the login username field; those commands run with the highest "root" privilege.

Who's affected: Sites using Lantronix EDS5000 device/serial servers — typically industrial, building-management or point-of-sale equipment that connects older serial devices to the network.

What to do: Apply the vendor firmware update. These boxes are often forgotten — make sure yours isn't directly exposed to the internet and sits on a separate part of the network.

12. Ubiquiti UniFi network gear — three actively-exploited flaws (CVE-2026-34908, -34909, -34910)

🛠️ Ubiquiti UniFi OS · added 23 Jun 2026 · CISA fix-by date 26 Jun 2026

What it is: Three weaknesses an attacker already on your network can chain together: command injection (run commands on the device), path traversal (read files they shouldn't), and improper access control (make unauthorised changes).

Who's affected: Anyone using Ubiquiti UniFi routers, switches, access points or the UniFi controller — very common in small offices, cafés, and shops because it's affordable prosumer kit.

What to do: Open your UniFi console and install the latest UniFi OS / firmware update. Keep the management console off the public internet, and use a strong, unique admin password.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.