CVEasy Weekly

This Week in Exposure

Week 31 · July 21 to July 27, 2026

This week the pattern was the fix that stops short of the finish line. Fastjson's own type-safety check, the routine meant to stop this exact attack, is where the attacker's bytecode ends up running, and the 1.x branch has no patch coming at all. SharePoint shipped a patch on July 14, but it leaves the machine keys an attacker already stole fully valid, so the ticket you closed is a door you left standing open. And a ServiceNow endpoint built for anonymous survey respondents became pre-auth code execution because two sandboxes quietly shared one scope.

Here is what mattered, ranked by real exposure, not just CVSS.

Top Exposures This Week

1. SharePoint machine-key theft that outlasts the patch

CVE-2026-50522 · Microsoft SharePoint Server (on-premises)

A single unauthenticated POST to /_trust/default.aspx, the WS-Federation sign-in handler, drives a deserialization primitive that exfiltrates the IIS machine keys off the server. The Patch Tuesday fix on July 14 closes the code path, but it does nothing to the keys an attacker already pulled. With those keys, a forged __VIEWSTATE authenticates as any user across every front-end web server that shares the farm keys, so patching one box does not evict anyone.

Risk read: A public proof-of-concept dropped on Sunday July 20, honeypots lit up within hours, and CISA added it to KEV on July 22. That is the top exploitation tier: unauthenticated, a working public exploit, and confirmed mass activity, on a CVSS 9.8. The exposure TRIS surfaces is the tail the advisory hides. TRIS holds this at ACT on any exposed node and only drops the band once a post-patch machine-key rotation is observed on that specific server, because a patched but un-rotated box is still an open door. Patch, then rotate the ASP.NET machine keys, the farm account, and the application pool identities on every front-end server before you call it contained.

Read the rotate-or-lose breakdown →

2. Fastjson runs your bytecode inside the type check

CVE-2026-16723 · Fastjson 1.2.68 through 1.2.83 in Spring Boot fat-JARs

Fastjson's checkAutoType gate is supposed to decide, before binding, whether a @type-carrying object is safe to hydrate. In the 1.2.68 through 1.2.83 window it does more than a name check: it probes the classpath for the target class and reads the @JSONType annotation off it, and a nested JAR URL turns that probe into a defineClass that loads attacker bytecode. The safety check is the sink. There is no patch on the 1.x branch.

Risk read: ThreatBook captured in-the-wild exploitation the day after disclosure, and by the weekend Imperva's telemetry showed active probes against US financial services, healthcare, computing, and retail. The payload runs with the privileges of the Java process, so the blast radius follows what your service can reach: actuator endpoints, embedded credentials, sibling service tokens, cloud instance metadata. With no 1.x patch to land, the fix is a configuration change, not a version bump. Flip SafeMode on every affected process today, then migrate to Fastjson 2. TRIS holds the finding at ACT for any exposed fat-JAR with SafeMode off, and only drops it once SafeMode is observed active.

Read the mechanism walk →

3. Two ServiceNow sandboxes that shared one scope

CVE-2026-6875 · ServiceNow AI Platform (self-hosted and unpatched cloud tenants)

The reachable sink is /assessment_thanks.do, served without authentication so a survey respondent can hit it from a link in an email. A javascript: prefix on the sysparm_assessable_type parameter reaches an inner sandbox, gs.include() pulls library code into an outer context, and because the two sandboxes share one global scope they can edit each other, which is the escape from evaluating an expression to running platform code pre-auth.

Risk read: Cloud tenants received a platform mitigation within 24 hours of the April 1 vendor report, so the exposed population today is self-hosted instances plus any cloud tenant still off the fixed patch train. It was patched July 13 and telemetry showed abuse in the wild by July 18. A proven proof-of-concept plus in-the-wild activity puts the exploitation layer in the top band, on a CVSS 9.5. The blast radius that matters is the MID Server: code execution on the platform reaches the credentials it holds into your internal network. Get on the fixed patch train, then rotate every credential the MID Server holds rather than assuming the patch alone closed the question.

Read the sandbox-escape breakdown →

Threat Actor Spotlight

None of these three carry a named crew behind them, and I am not going to invent one from a honeypot hit. What the public reporting does establish is the tempo. ThreatBook logged Fastjson exploitation the day after disclosure, Imperva watched probes sweep US financial services, healthcare, and retail by the weekend, and the SharePoint proof-of-concept went public on a Sunday with CISA adding it to KEV inside 48 hours. This is opportunistic, proof-of-concept-driven mass exploitation, and the operators running it are not writing the exploit, they are racing the clock between a public advisory and your patch window. Hardening takeaway: assume that window is now measured in hours, and that patching is only half the job whenever the bug already leaked a secret. A stolen SharePoint machine key, a MID Server credential, an actuator token behind a Fastjson process, none of them are rotated by the patch that closed the hole. Rotate what the exploit could already have touched, do not just shut the door behind it.

Signed CVEasy threat-intel IOC bundle current as of 2026-07-27. The desktop app verifies the ED25519 signature before import.

Every item this week had a fix that stopped short of the finish line. A patch with no branch to land on, a patch that leaves stolen keys valid, a patch train that half your tenants are not on. A scanner queue tells you a CVE exists and a patch shipped; it does not tell you that this specific box still has SafeMode off, still shares an unrotated machine key, or still runs a MID Server whose credentials an attacker copied on Saturday. Two servers under the same advisory are two different exposures, and the work is knowing which one is still open on Monday morning. That is the gap TRIS closes inside our CTEM platform, and the gap I want this letter to close for you every week.

Patch well,
Chris Boker
Founder, CVEasy AI