Daily briefing · July 7, 2026
9Router OS Injection Under Active Exploitation as 10 Critical CVEs Surface on July 7
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
July 7 brings an ATTENTION-level day with one vulnerability already observed in active exploitation by VulnCheck ahead of any official CISA confirmation: a critical OS command injection in 9Router that allows unauthenticated remote code execution via a single POST request. Alongside it, nine additional critical-severity vulnerabilities span self-hosted infrastructure tools, enterprise platforms, and widely deployed WordPress plugins, collectively representing a broad and urgent patch surface for defenders.
Today’s brief
- 9Router CVE-2026-59800 is under active exploitation (VulnCheck-confirmed before CISA) — unauthenticated RCE via a single API call, patch immediately
- Coolify receives two CVSS 9.9 flaws: unauthorized terminal access and cross-tenant resource cloning — both exploitable by low-privileged users
- WPFunnels and uncanny-automator-pro WordPress plugins carry critical RCE paths, the latter tied to a confirmed supply-chain compromise
- Esri ArcGIS Portal and Dell PowerProtect Data Domain expose unauthenticated API access and path traversal to remote attackers
Critical highlights
1
An unauthenticated attacker can inject arbitrary OS commands through the POST /api/tunnel/tailscale-install endpoint in 9Router before 0.4.44, as the route bypasses all authorization middleware and pipes attacker-controlled input directly to a shell process. VulnCheck observed exploitation in the wild before CISA acted — this is the highest-urgency item of the day and demands immediate upgrade or network-level restriction of the API endpoint.
2
In Coolify prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes authenticate users but never verify terminal authorization, meaning any low-privileged team member can attach to server terminals and execute arbitrary commands. The blast radius extends to all servers managed under the same Coolify instance, making lateral movement trivial for an insider or a compromised team account.
3
Also in Coolify (pre-4.0.0-beta.464), the cloneTo() Livewire action validates the source resource but resolves destinations via unscoped database queries, enabling an authenticated user to clone resources into teams they do not belong to and access cross-tenant data. This is a classic broken object-level authorization flaw that can silently expose other tenants' configurations and secrets.
4
Plesk's XML-RPC API before version 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants by bypassing ownership enforcement on certain query filters and exploiting schema validation gaps in legacy protocol versions. Worse, the exposed data includes FTP credentials stored in cleartext, which can be immediately leveraged for unauthorized server access across tenants.
5
CVE-2026-14345CVSS 9.8affects WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell The WPFunnels WordPress plugin through version 3.12.7 allows unauthenticated attackers to achieve remote code execution by writing attacker-controlled values into a PHP-includeable log file, which is then loaded via include_once during rendering. Any WordPress site running WooCommerce funnels with this plugin version should treat exposure as critical and patch or deactivate without delay.
6
Apache Airflow's BaseSerialization.deserialize() permitted unrestricted import of attacker-controlled class paths when processing serialized DAGs, allowing a malicious DAG author to embed a trigger that executes arbitrary code in the Scheduler or API Server process — directly breaching Airflow's stated security boundary. Organizations running multi-tenant or externally-authored DAG pipelines face the highest risk and should prioritize patching the affected Airflow versions.
7
The uncanny-automator-pro WordPress plugin before version 7.3.0.6 was distributed with injected backdoor code after a confirmed compromise of the vendor's distribution infrastructure — a supply-chain attack that grants unauthenticated visitors an administrator session and exfiltrates site secret keys and admin credentials to attacker-controlled endpoints. A proof of concept is already public, and any site that installed or auto-updated to an affected version must be treated as fully compromised.
8
DBI for Perl before version 1.650 contains a heap overflow triggered by SQL statements with an extreme number of placeholders, a bypass of the incomplete fix introduced for CVE-2026-10879. Applications that process externally influenced SQL or accept dynamic query structures with large placeholder counts are vulnerable to memory corruption that could lead to arbitrary code execution.
9
Esri Portal for ArcGIS versions 12.1 and earlier expose an unprotected critical API endpoint that requires no authentication whatsoever, allowing any remote attacker to interact with privileged GIS infrastructure functions. Organizations running ArcGIS Portal on Windows, Linux, or Kubernetes should restrict network access to the portal and apply the vendor patch as soon as it becomes available.
10
Dell PowerProtect Data Domain across a wide range of versions (7.7.1.0 through 8.7 and multiple LTS branches) contains a path traversal vulnerability exploitable by unauthenticated remote attackers, potentially enabling access to restricted files or directories on backup infrastructure. Given that Data Domain systems store enterprise backups, successful exploitation could expose highly sensitive data or facilitate ransomware staging.
Ransomware today
Ransomware activity recently hit three Brazilian organizations: tecnocurva.com.br (Technology sector) was claimed by incransom, Francisco Imóveis (Consumer Services) by the Doommageddon group, and redeplastrs.com.br (Manufacturing) by Blackfield. Looking at the broader 30-day picture, lockbit3, ransomhub, and lockbit5 lead as the most active groups, with lockbit3 alone accounting for 39 incidents — all attributed to Brazilian targets — underscoring the sustained and targeted pressure on Brazilian organizations across all sectors.
tecnocurva.com.br BRincransom · Technology
Francisco Imóveis BRDoommageddon · Consumer Services
redeplastrs.com.br BRBlackfield · Manufacturing
lockbit3 39ransomhub 35lockbit5 26thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors are currently being tracked as active or recently updated, including againstthewest, apt73, blackshadow (Iran-linked), dragonforce, fulcrumsec, and coinbasecartel, though no confirmed victims have been attributed to them in the current tracking window. Notably, apt73 has been linked to activity targeting flazio.com, a Technology sector company with Brazilian ties, and the group's operational posture warrants continued monitoring by defenders in that space.
Brazil focus
Brazil continues to be a high-intensity target in the current threat landscape, with at least eight organizations identified as recent ransomware victims across Technology, Consumer Services, Manufacturing, and Business Services sectors — including tecnocurva.com.br, Francisco Imóveis, redeplastrs.com.br, ezortea.com.br, tambasa.com, carvalima.com.br, flazio.com, and Service IT. The combination of active groups like incransom (responsible for multiple Brazilian victims) and emerging actors like Doommageddon and Blackfield signals that Brazilian organizations face a diverse and opportunistic threat ecosystem, not a single coordinated campaign.
tecnocurva.com.brincransom · Technology
Francisco ImóveisDoommageddon · Consumer Services
redeplastrs.com.brBlackfield · Manufacturing
ezortea.com.brincransom · Consumer Services
tambasa.comincransom
carvalima.com.brincransom · Business Services
flazio.comapt73 · Technology
Service ITworldleaks · Business Services
Today’s recommendation: Defenders should treat CVE-2026-59800 (9Router) as an emergency given confirmed active exploitation — restrict or disable the affected API endpoint immediately if a patch cannot be applied at once, and review all Coolify, Plesk, and WordPress plugin versions against the affected ranges disclosed today. For the supply-chain compromise in uncanny-automator-pro, incident response procedures should be initiated on any site that ran an affected version, as backdoor access may already have been established.
With critical unauthenticated RCE and active exploitation confirmed across infrastructure and CMS platforms today, there is no substitute for continuously validating your own external and internal attack surface to understand which of these exposures are actually reachable in your environment.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →