TPRM Insights: Progress ShareFile SZC, SonicWall SMA1000, MSSQL, Exchange Server, Zimbra, Roundcube, FreeBSD, and SharePoint

Introduction

This week's Focus Friday is defined by Microsoft's July 14, 2026 Patch Tuesday — one of the largest single-month disclosure events in recent history, with 570 vulnerabilities patched across Microsoft's product portfolio — alongside two actively exploited zero-day chains discovered by Rapid7's MDR team in SonicWall SMA1000 appliances and an ongoing emergency at Progress ShareFile where a path traversal vulnerability in Storage Zone Controllers prompted Progress to disable customer accounts and urge immediate server shutdowns. The week covers seven FocusTags® spanning enterprise file sharing infrastructure, secure remote access gateways, database servers, email servers, collaboration platforms, webmail applications, and operating system kernels.

The SonicWall SMA1000 zero-day chain is this week's most immediately dangerous active exploitation event: a CVSS 10.0 unauthenticated SSRF vulnerability (CVE-2026-15409) chained with a post-authentication code injection flaw (CVE-2026-15410) is being actively exploited by threat actors to achieve full SMA1000 appliance compromise, extract session databases and TOTP MFA seeds, and pivot laterally into Active Directory environments. These appliances function as the SSL VPN gateway for the organizations that deploy them, meaning a compromised SMA1000 represents an adversary-controlled foothold at the perimeter of the vendor's entire network. From Patch Tuesday, Microsoft SQL Server (8 CVEs, CVSS up to 9.8) and Exchange Server (4 CVEs, CVSS up to 9.6) carry the highest-urgency disclosure burdens: SQL Server's unauthenticated heap buffer overflow in the ODBC driver enables client-side RCE without touching the server itself, while Exchange Server's critical OWA XSS flaw requires no authentication and supersedes a previously deployed emergency mitigation.

The Progress ShareFile Storage Zone Controller situation adds a supply-chain urgency dimension: the vulnerability directly affects the customer-managed physical storage layer where enterprise files reside, Progress has not yet published a CVE identifier (It is expected in two weeks), and the emergency account disablement action taken on July 10 reflects the severity of the threat before patches in 5.12.5 and 6.0.2 were available. Zimbra and Roundcube both carry zero-click stored XSS vulnerabilities this week — email-borne attack paths requiring only that a crafted message be delivered and opened — with Zimbra's flaw reported by Google's Threat Analysis Group, signaling nation-state threat actor interest. FreeBSD's three local privilege escalation kernel flaws complete the week, targeting the OS foundation of storage appliances, firewalls, and hosting platforms that underpin vendor infrastructure. Additionally, the existing SharePoint FocusTag® has been expanded this week to incorporate three newly disclosed SharePoint CVEs, two of which received CISA KEV listings on July 14 and July 16, 2026.

Filtered view of vendors with Progress ShareFile SZC FocusTag® on the Black Kite platform.

Progress ShareFile SZC

You can access our detailed technical analysis of the ShareFile incident here:

What is this vulnerability?

A path traversal vulnerability in Progress ShareFile Storage Zone Controller (SZC) was confirmed on July 14, 2026, affecting all 5.x and 6.x SZC versions. A CVE identifier has been reserved by Progress and It is expected in two weeks. The vulnerability requires an authenticated administrative user account. An attacker with this access level can leverage the path traversal to: read arbitrary files accessible to the application's service account, write attacker-controlled content to arbitrary directories on the server, and enumerate the server's file system layout.

ShareFile Storage Zone Controller is an on-premises component hosted on the customer's own infrastructure — separate from ShareFile's SaaS/cloud platform — that manages the physical storage layer for files shared via the ShareFile service. Organizations deploy SZC where they need data sovereignty, regulatory compliance, or security control over where their file data physically resides. Because SZC manages this storage layer directly, a successful exploit represents access to the customer-controlled storage infrastructure itself, not merely a front-end compromise. The new July path traversal is reported to be a distinct vulnerability class from the earlier CVE-2026-2699 (pre-authentication authentication bypass) and CVE-2026-2701 (RCE) chain disclosed by watchTowr Labs, which was already patched in version 5.12.4 on March 10, 2026. A claim has circulated suggesting the older chain can be combined with the new path traversal, but this connection has not been confirmed by the vendor and is characterized as speculation.

The severity of this vulnerability was underscored by Progress's emergency response: on July 10, 2026, Progress emailed customers describing a 'credible external security threat' and urging them to manually shut down their SZC servers as a critical protective step, while also disabling ShareFile accounts that use Storage Zone Controllers. Progress has stated it has no indication of unauthorized access to any ShareFile accounts or customer data to date. No public PoC exploit is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Patches are available in SZC versions 5.12.5 (5.x branch) and 6.0.2 (6.x branch). Black Kite's tagging for this vulnerability uses MEDIUM confidence (product-based detection only, as version discrimination is not yet possible ahead of CVE publication).

Why should TPRM professionals care?

ShareFile is widely deployed across professional services, legal, financial, and healthcare organizations as a secure enterprise file sharing and client collaboration platform. The Storage Zone Controller component — the specific target of this vulnerability — is the on-premises layer that stores actual file content, including contracts, client documents, financial records, and sensitive business materials that organizations specifically chose to keep on their own infrastructure rather than in ShareFile's cloud. A path traversal vulnerability giving an authenticated administrative attacker arbitrary file read and write access to this layer therefore reaches directly into the physical storage of the organization's most sensitive managed content. For TPRM professionals, the emergency shutdown directive Progress issued to SZC customers is itself a significant signal: it is unusual for a vendor to instruct customers to take entire service components offline as a protective measure, and this action should trigger immediate vendor engagement to confirm patch status regardless of whether exploitation has been confirmed against any specific vendor in the portfolio. The file transfer platform category has a disproportionate presence in CISA KEV and major breach events — MOVEit (2023), Cleo Harmony (2024), GoAnywhere (2025) — establishing a threat actor pattern that makes any new vulnerability in this space inherently high-priority.

What questions should TPRM professionals ask vendors?

1. Has Progress ShareFile Storage Zone Controller been upgraded to version 5.12.5 (5.x series) or 6.0.2 (6.x series) — the patched releases addressing the July 2026 path traversal vulnerability? What version is currently confirmed installed?

2. Were SZC servers shut down immediately upon receiving Progress's July 10 emergency notification? For what duration were SZC servers running after the threat was identified but before the patch was applied?

3. Has a forensic review of SZC server file system access logs been conducted for unauthorized file access or unexpected directory traversal patterns during the vulnerability window? Have any anomalous administrative account activities been identified?

4. Were SZC administrative account credentials rotated after the patch was applied? Given that the vulnerability is exploitable by authenticated administrative accounts, any compromise of administrative credentials during the exposure window warrants credential rotation.

5. Has the earlier pre-authentication RCE chain (CVE-2026-2699 + CVE-2026-2701, patched in SZC 5.12.4 on March 10, 2026) also been remediated? Any deployment still on versions prior to 5.12.4 is exposed to both the older pre-auth chain and the new path traversal.

Remediation recommendations

Upgrade Storage Zone Controller to version 5.12.5 (5.x) or 6.0.2 (6.x) immediately — these are the only releases addressing the July 2026 path traversal vulnerability. For deployments also running versions prior to 5.12.4, remediate CVE-2026-2699 and CVE-2026-2701 simultaneously.
Confirm SZC servers were shut down upon receipt of Progress's July 10 emergency notification, and ensure they remain patched before being brought back online. Do not restore SZC service on unpatched versions.
Conduct a retroactive file access audit on SZC servers for evidence of unauthorized traversal or access to files outside expected paths during the exposure window. Review SZC administrative account audit logs for unexpected login times, source IPs, or file operations.
Rotate credentials for all SZC administrative accounts as a precautionary measure. Restrict SZC administrative access to trusted IP ranges and enforce MFA for all accounts with SZC administrative privileges.
Monitor Progress Software's official communications and It is expected in two weeks, for any updated technical details, additional affected versions, or changes to the threat assessment.

Black Kite's Progress ShareFile SZC FocusTag® details critical insights on the event for TPRM professionals.

SharePoint - Jul2026 FocusTag® Update

In addition to the seven new FocusTags® this week, Black Kite has expanded the existing SharePoint FocusTag® — originally published on July 3, 2026 for CVE-2026-45659 — to incorporate three newly disclosed Microsoft SharePoint vulnerabilities: CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644. CVE-2026-56164 was added to CISA's Known Exploited Vulnerabilities catalog on July 14, 2026, and CVE-2026-58644 received a CISA KEV listing on July 16, 2026. These additions reflect the continued active threat actor focus on on-premises SharePoint Server as a high-value target and further reinforce the urgency of applying all available SharePoint security updates across the July patch cycle. TPRM professionals who engaged vendors regarding the original SharePoint tag should include these three CVEs in follow-up verification, confirming that the July 2026 SharePoint patching cycle is complete and that no CVE in the expanded tag set remains unaddressed.

SonicWall SMA1000 - Jul2026 (CVE-2026-15409, CVE-2026-15410)

What is this vulnerability?

Two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — affect SonicWall SMA1000 Series secure access gateways and are being actively chained by threat actors to achieve full appliance compromise. Both were discovered by Rapid7's MDR team during active incident response. CVE-2026-15409 (CVSS 10.0) is a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw allows a remote, unauthenticated attacker to force the appliance to make requests to unintended locations — a no-credentials-required network-reachable SSRF that serves as the entry point for the exploit chain. CVE-2026-15410 is a code injection vulnerability in the SMA1000 Appliance Management Console (AMC) that may allow a remote attacker authenticated as an administrator to execute arbitrary OS commands and achieve Remote Code Execution.

In confirmed exploitation chains observed in the wild, threat actors use CVE-2026-15409 to gain unauthenticated access, leverage that foothold to authenticate to the AMC, and then exploit CVE-2026-15410 to achieve OS-level command execution on the appliance. The consequence of full SMA1000 compromise in active attack campaigns includes: extraction of stored credentials, session databases, and TOTP MFA seed values (enabling bypass of multi-factor authentication), and lateral movement into the internal Active Directory environments that the VPN gateway protects. SonicWall contacted affected customers in advance of public disclosure to provide hotfixes (v12.4.3-03453 for the 12.4.3 branch and 12.5.0-02835 for the 12.5.0 branch) before making them broadly available on July 14, 2026. Approximately 1,793 SMA1000 instances matching affected major/minor/patch version strings are detectable on Shodan — this figure represents potential exposure requiring build-level verification, as the Shodan query cannot distinguish vulnerable hotfix builds from patched ones sharing the same version string.

Why should TPRM professionals care?

SonicWall SMA1000 series appliances function as the SSL VPN gateway and secure remote access perimeter for medium-to-large enterprises, government agencies, and managed security service providers. The appliance is positioned at the boundary of the organization's internal network: every remote employee, contractor, and partner connects through it, and it holds the authentication and authorization context for the entire remote access population. A full SMA1000 compromise at this perimeter position is not an endpoint compromise — it is an adversary-controlled insertion point into the vendor's network with authenticated access to everything the VPN gateway connects to. The extraction of TOTP MFA seeds is particularly severe: it enables attackers to bypass multi-factor authentication for any account whose TOTP was registered through the compromised appliance, creating persistent authentication bypass that survives appliance reimaging unless TOTP tokens are also reset. SonicWall itself recommends that if compromise indicators are present, customers re-image hardware or redeploy virtual appliances, change all user and administrator passwords, and reset all TOTP tokens — a full credential infrastructure rebuild at the remote access layer.

What questions should TPRM professionals ask vendors?

1. Have SonicWall SMA1000 appliances been patched to hotfix builds v12.4.3-03453 or 12.5.0-02835 — the specific builds addressing CVE-2026-15409 and CVE-2026-15410? What build number is confirmed installed on each SMA1000 deployment, including any virtual instances?

2. Have SonicWall-provided indicators of compromise been checked on each SMA1000 appliance to determine whether exploitation occurred prior to patching? SonicWall offered to run an IoC verification script on behalf of affected customers.

3. If any IoC was found: have all user and administrator passwords been rotated, all TOTP tokens been reset, and has the appliance been re-imaged (hardware) or redeployed (virtual) as SonicWall recommends? Patching alone is insufficient if exploitation has already occurred.

4. Have SMA1000 audit logs been reviewed for unauthorized sessions, credential extraction events, unexpected AMC access, or unusual outbound connections that may indicate active exploitation and lateral movement during the exposure window?

5. Is SMA1000 Work Place interface access restricted to trusted IP ranges, or is it publicly internet-accessible? Restricting internet exposure of the Work Place interface eliminates the unauthenticated SSRF attack surface for CVE-2026-15409.

Remediation recommendations

Apply hotfix build v12.4.3-03453 (for 12.4.3 branch) or 12.5.0-02835 (for 12.5.0 branch) immediately on all SMA1000 appliances. These specific hotfix builds are the only releases addressing CVE-2026-15409 and CVE-2026-15410. Version string alone (12.4.3 or 12.5.0) is insufficient to confirm remediation — the exact hotfix build number must be verified.
Run SonicWall's IoC verification check on each appliance before and after patching. If any compromise indicators are found, follow SonicWall's full remediation protocol: re-image or redeploy the appliance, rotate all user and administrator passwords, and reset all TOTP tokens for all users registered through the compromised device.
Conduct a forensic review of SMA1000 access logs, session records, and credential stores for evidence of unauthorized access during the zero-day exposure window, including any unexpected session authentications, AMC access, or anomalous outbound connections from the appliance.
Restrict SMA1000 Work Place interface access to known-good source IP ranges where operationally feasible. Network-level restriction of the unauthenticated SSRF endpoint (CVE-2026-15409) significantly reduces the attack surface against internet-facing appliances.
Treat any vendor with an unpatched internet-facing SMA1000 as a high-priority active risk: this zero-day chain is being actively exploited in the wild with full appliance takeover and lateral AD movement as confirmed outcomes.

Black Kite's SonicWall SMA1000 - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

MSSQL - Jul2026 (CVE-2026-42990, CVE-2026-54117, CVE-2026-54118, CVE-2026-47295, CVE-2026-54116, CVE-2026-50468, CVE-2026-47296, CVE-2026-55002)

What is this vulnerability?

Eight vulnerabilities disclosed by Microsoft as part of the July 14, 2026 Patch Tuesday release affect Microsoft SQL Server versions 2016 through 2025. CVSSv3 scores range from 6.5 to 9.8. No mitigations or workarounds exist for any of the eight vulnerabilities; SQL Server version upgrades are the only remediation path.

CVE-2026-42990 (CVSS 9.8, EPSS 0.67%) is the defining threat driver: a heap-based buffer overflow in the SQL Server ODBC driver requiring no authentication. An attacker who sets up a malicious SQL Server and convinces a user or application to connect can send specially crafted network data to trigger the flaw on the connecting client, achieving code execution entirely outside the server itself. This client-side attack path is particularly dangerous in enterprise environments where automated ETL pipelines, reporting tools, business intelligence applications, and application services routinely establish outbound SQL Server connections. CVE-2026-54117 and CVE-2026-54118 (both CVSS 8.8, EPSS 1.29% — the highest in this cluster) enable authenticated attackers with explicit permissions to escalate directly to sysadmin through unsafe deserialization over the network, with low attack complexity and no user interaction required. CVE-2026-47295 (CVSS 8.8, EPSS 0.92%) adds a third independent path to full SQL Server administrative control through SQL injection via crafted malicious database names that inject arbitrary T-SQL commands over the network.

CVE-2026-54116 (type confusion leaking internal memory pointers, EPSS 0.95%) and CVE-2026-50468 (buffer over-read leaking heap memory contents, EPSS 0.72%) are information disclosure vulnerabilities that function as exploitation enablers: leaked memory addresses directly facilitate ASLR bypass, lowering the exploitation complexity of the RCE-class vulnerabilities in chained attack scenarios. CVE-2026-47296 and CVE-2026-55002 provide local privilege escalation paths via external file path control. Collectively, this cluster establishes multiple independent, reliable routes from authenticated low-privilege sessions to full SQL Server administrative control, combined with unauthenticated client-side RCE via the ODBC driver and information disclosure primitives that lower the exploitation bar for the entire set.

Why should TPRM professionals care?

Microsoft SQL Server is the primary database platform for ERP, CRM, financial, and business intelligence systems across enterprise organizations, making it one of the highest-value targets for database-level compromise in vendor environments. A sysadmin-level escalation via any of the three authenticated-to-admin CVEs (CVE-2026-54117, CVE-2026-54118, CVE-2026-47295) grants full database administrative control — including access to every database on the instance, the ability to read and exfiltrate any stored data, and the ability to execute (SQL Server command-shell feature) for OS-level command execution if enabled. The unauthenticated client-side attack vector in CVE-2026-42990 is especially concerning for third-party risk: it does not require the vendor's SQL Server itself to be internet-accessible — it targets any application or pipeline that connects outbound to an attacker-controlled SQL endpoint, a threat model that encompasses supply chain attacks, malicious redirect scenarios, and any application that processes external SQL Server connection strings.

What questions should TPRM professionals ask vendors?

1. Have all Microsoft SQL Server instances been patched with the July 14, 2026 Cumulative Updates addressing CVE-2026-42990, CVE-2026-54117, CVE-2026-54118, CVE-2026-47295, CVE-2026-54116, CVE-2026-50468, CVE-2026-47296, and CVE-2026-55002? What is the confirmed patch level across all SQL Server versions (2016–2025) in the environment?

2. For CVE-2026-42990 (unauthenticated ODBC driver RCE): have ETL pipelines, reporting applications, and business intelligence tools been reviewed for connections to external or untrusted SQL Server endpoints? Any application that connects to a SQL Server controlled by an attacker — including redirect scenarios — is a potential client-side exploitation vector.

3. Are SQL Server instances internet-facing or accessible without network segmentation? The three authenticated-to-sysadmin CVEs (CVE-2026-54117/54118/47295) require network access to the SQL Server; network-level restriction reduces the exploitable population to authenticated users already on the network.

4. Are (SQL Server command-shell feature) and other OS-integration features explicitly disabled on SQL Server instances that do not require them? Sysadmin-level access enabled by this cluster can be used to enable (SQL Server command-shell feature) if not already disabled, extending impact to OS-level command execution.

5. Have the two information disclosure CVEs (CVE-2026-54116 and CVE-2026-50468) been specifically evaluated for potential exploitation as ASLR-bypass enablers in chained attacks? Memory layout disclosure can lower the exploitation difficulty for the RCE-class vulnerabilities in this cluster.

Remediation recommendations

Apply the July 14, 2026 Cumulative Updates for all in-scope SQL Server versions (2016 through 2025) immediately. No mitigations or workarounds exist for any of the eight CVEs — patching is the only remediation path.
Audit and restrict SQL Server outbound connectivity policies: applications and pipelines that connect to external SQL Server endpoints should be reviewed for whether those endpoints are trusted. The CVE-2026-42990 ODBC driver attack vector targets connecting clients, not the SQL Server itself.
Enforce network segmentation to restrict SQL Server port access (default TCP 1433) to authorized application servers and database administrators only. Eliminate any direct public internet exposure of SQL Server instances.
Disable (SQL Server command-shell feature) and other high-risk SQL Server extended procedures where not operationally required, using sp_configure. Sysadmin-level access obtained via this cluster can re-enable these features if they are not locked down at the configuration level.
Audit SQL Server user accounts and permissions post-patching: review which accounts hold 'explicit permissions' that could enable CVE-2026-54117/54118 deserialization escalation, and apply principle of least privilege to all SQL Server accounts.

Black Kite's MSSQL - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

Exchange Server - Jul2026 (CVE-2026-55008, CVE-2026-55005, CVE-2026-55006, CVE-2026-55009)

What is this vulnerability?

Four vulnerabilities disclosed by Microsoft as part of the July 14, 2026 Patch Tuesday release affect Microsoft Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. CVSSv3 scores range from 7.8 to 9.6. All four are fully remediated by applying the July 14, 2026 Security Updates via Knowledge Base articles 5103212 (Exchange 2016 CU23), 5103213, 5103214 (Exchange 2019 CU14/CU15), and 5103215 (Exchange SE RTM).

CVE-2026-55008 (CVSS 9.6, EPSS 0.73%) is the only Critical-rated flaw in this cluster and the most immediately significant. Rated by Microsoft as 'Exploitation More Likely,' it allows any unauthenticated remote attacker to deliver a specially crafted email that, when opened by the recipient in Outlook Web Access (OWA), triggers arbitrary JavaScript execution in the victim's browser context. The Changed Scope CVSS indicator (S:C) combined with full high confidentiality, integrity, and availability impact confirms that successful exploitation extends beyond the victim's OWA session — enabling session token theft, credential harvesting, unauthorized email access, and lateral movement via the victim's authenticated Exchange context. Microsoft's advisory notes that this patch supersedes the previously deployed CVE-2026-42897 emergency mitigation, indicating a direct lineage to an already-recognized active threat in Exchange.

CVE-2026-55009 (CVSS 7.8, EPSS 1.65%) carries the highest EPSS score in this cluster despite its local attack vector — a signal that exploitation techniques for this deserialization-based local privilege escalation path are well understood within the research community. CVE-2026-55005 (CVSS 8.8, EPSS 0.66%) enables any authenticated low-privileged user to trigger a heap-based buffer overflow over the network to achieve RCE on the Exchange server. CVE-2026-55006 (CVSS 7.8, EPSS 0.22%) provides a local privilege escalation path via insufficient access control granularity.

Why should TPRM professionals care?

On-premises Microsoft Exchange Server is the corporate email, calendar, and messaging infrastructure for organizations that have not migrated to Exchange Online — it is routinely internet-accessible via Outlook Web Access and ActiveSync, making every unpatched Exchange deployment an externally reachable target for CVE-2026-55008's unauthenticated XSS attack. The Changed Scope impact of this flaw means successful exploitation against any user — including a standard employee — yields JavaScript execution with that user's authenticated Exchange session, potentially accessing email content, contacts, calendar data, and any information accessible through OWA. The EPSS 1.65% on CVE-2026-55009 is a meaningful signal: despite its local attack vector, the research community's familiarity with this deserialization LPE class suggests near-term weaponization is probable once the patch details enable vulnerability characterization. The supersession of CVE-2026-42897's emergency mitigation by the CVE-2026-55008 patch indicates that the underlying Exchange vulnerability surface in OWA has been an active area of threat actor targeting.

What questions should TPRM professionals ask vendors?

1. Have the July 14, 2026 Exchange Security Updates been applied across all on-premises Exchange Server deployments — specifically KB5103212 (Exchange 2016 CU23), KB5103213/5103214 (Exchange 2019 CU14/CU15), and KB5103215 (Exchange SE RTM)?

2. For CVE-2026-55008: is OWA (Outlook Web Access) internet-accessible without additional authentication layers? Given the unauthenticated exploit delivery path via specially crafted email, any internet-facing OWA endpoint is directly reachable by this attack.

3. Has the superseded CVE-2026-42897 emergency mitigation been confirmed as replaced by the full July 14 Security Update? Partial or interim mitigations should not be treated as equivalent to applying the full patch.

4. For CVE-2026-55005: have authenticated low-privilege Exchange user accounts been reviewed for any anomalous mailbox operations, unusual transport rule creation, or unexpected remote access that may indicate prior exploitation of the heap overflow RCE path?

5. Are Exchange administrative roles and permissions audited on a regular schedule? The local privilege escalation CVEs (CVE-2026-55006 and CVE-2026-55009) exploit insufficient access controls and deserialization paths that may be present in long-running Exchange deployments with legacy permission configurations.

Remediation recommendations

Apply the July 14, 2026 Exchange Security Updates immediately: KB5103212 for Exchange Server 2016 CU23, KB5103213 or KB5103214 for Exchange Server 2019 CU14 or CU15 respectively, and KB5103215 for Exchange Server Subscription Edition RTM.
Restrict OWA internet access where operationally feasible: require VPN or conditional access authentication before reaching the OWA endpoint to eliminate the unauthenticated delivery surface for CVE-2026-55008. If OWA must remain internet-accessible, apply the patch immediately and monitor for anomalous JavaScript execution or session token abuse.
Remove any previously deployed CVE-2026-42897 interim mitigation scripts and confirm that the full July 14 Security Update is applied — partial mitigations do not address the full vulnerability surface of CVE-2026-55008.
Review Exchange mailbox audit logs and OWA access logs for anomalous activity patterns consistent with session hijacking — unexpected IP addresses accessing authenticated sessions, unusual mail operations, or unexpected transport rule creation that may indicate prior exploitation.
Audit Exchange role assignments and permissions: the local LPE CVEs exploit insufficient access control granularity and deserialization paths — ensuring least-privilege role assignments reduces the impact of these vectors on compromised Exchange environments.

Black Kite's Exchange Server - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

Zimbra - Jul2026

What is this vulnerability?

A high-risk stored Cross-Site Scripting (XSS) vulnerability has been disclosed in the Classic Web Client component of Zimbra Collaboration Suite (ZCS). The vulnerability does not currently have an assigned CVE identifier or an official CVSS score. It was reported by Google's Threat Analysis Group (TAG) — the team that investigates nation-state and sophisticated threat actor activity targeting high-risk individuals and organizations.

The vulnerability allows a remote, unauthenticated attacker to deliver malicious script content through a specially crafted email. No Zimbra credentials are required; no attachment download, macro enablement, or external link click is needed from the victim. The only prerequisite is that the targeted user opens the malicious email using the vulnerable Classic Web Client on an affected Zimbra instance. When the email is rendered, attacker-controlled JavaScript executes under the Zimbra application origin within the victim's authenticated Zimbra session. Successful exploitation may enable an attacker to read mailbox content, access contacts and account settings, retrieve session-accessible data, modify mailbox preferences, create forwarding rules, or perform other mailbox operations with the victim's session privileges. Zimbra has not confirmed active exploitation of this specific vulnerability in the wild. The vulnerability affects Zimbra Collaboration Suite 10.1.x versions prior to 10.1.19 and is fixed in ZCS 10.1.19.

Why should TPRM professionals care?

Zimbra Collaboration Suite is one of the most widely deployed enterprise email and collaboration platforms outside the Microsoft ecosystem, used extensively by government agencies, critical infrastructure operators, financial institutions, and enterprises across Europe, Asia, and government-adjacent sectors. Its history as a target for advanced threat actors — including multiple prior KEV listings and documented nation-state exploitation campaigns — makes any newly disclosed email-rendering vulnerability a priority disclosure regardless of initial exploitation status. The involvement of Google's Threat Analysis Group as the reporting entity is a significant threat intelligence signal: TAG investigates attacks targeting high-risk individuals and organizations, including government officials, journalists, human rights defenders, and high-value enterprise targets. TAG's interest in this flaw indicates at minimum research-level attacker interest in the vulnerability surface, and historically, TAG-discovered vulnerabilities in email platforms have preceded targeted exploitation campaigns. For TPRM professionals, any vendor running ZCS 10.1.x prior to 10.1.19 represents elevated risk given the combination of zero-click email delivery, authenticated session access, and the threat actor profile associated with Zimbra targeting.

What questions should TPRM professionals ask vendors?

1. Has Zimbra Collaboration Suite been upgraded to version 10.1.19 — the release that addresses the Classic Web Client stored XSS vulnerability disclosed in July 2026? What ZCS version is currently confirmed deployed?

2. Is the Zimbra Classic Web Client the primary webmail interface in use, or has migration to the Modern Web Client been completed? The disclosed XSS vulnerability specifically affects the Classic Web Client rendering path.

3. Has the Zimbra installation been audited for anomalous mail forwarding rules, unexpected account setting changes, or unusual session activity that may indicate prior exploitation via email-delivered XSS — even absent confirmed exploitation, given the low-friction delivery mechanism?

4. Is Zimbra's webmail interface accessible directly from the public internet, or restricted behind VPN or conditional access? Internet-facing Zimbra OWA equivalent access is the required delivery condition for this attack.

5. What is the process and timeline for applying Zimbra security patches? Given Google TAG's involvement in reporting this flaw, what threat intelligence feeds or vendor security bulletins does the team monitor for Zimbra-related advisories?

Remediation recommendations

Upgrade Zimbra Collaboration Suite to version 10.1.19 immediately. This is the only release that addresses the Classic Web Client stored XSS vulnerability. All 10.1.x versions prior to 10.1.19 are affected.
Consider migrating end users from the Classic Web Client to the Modern Web Client where operationally feasible, as the XSS vulnerability is specific to the Classic Web Client rendering engine.
Audit Zimbra mailbox accounts for anomalous forwarding rules, unexpected contact exports, or modified account settings that may indicate session-level access by an unauthorized party — particularly for high-value accounts such as executives, legal, finance, and IT administrators.
Restrict direct internet access to Zimbra's webmail interface where operationally feasible; enforce additional authentication layers (SSO, MFA, conditional access) for any internet-facing Zimbra endpoint.
Monitor Zimbra security advisories from the official wiki and blog (wiki.zimbra.com/Security_Center) and act on TAG-related disclosures with elevated priority given the nation-state threat actor relevance historically associated with Zimbra vulnerabilities.

Black Kite's Zimbra - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

Roundcube - Jul2026 (CVE-2026-54433)

What is this vulnerability?

CVE-2026-54433 (CVSS 7.2) is a zero-click stored Cross-Site Scripting vulnerability in Roundcube Webmail, a widely deployed open-source webmail application used across enterprise, shared hosting, education, and government environments. The flaw exists in Roundcube's plain-text email rendering mechanism, which fails to properly escape specially crafted message content before rendering it in the browser. A remote, unauthenticated attacker exploits this vulnerability simply by sending a malicious email to a targeted Roundcube user. When the message is rendered in the affected webmail interface, attacker-controlled JavaScript executes in the context of the victim's authenticated Roundcube session. No attachment, macro, or external link interaction is required from the victim — message rendering alone is the trigger. No confirmed active exploitation or public PoC has been reported at time of publication. The vulnerability affects Roundcube 1.6.x prior to 1.6.17 and 1.7.x prior to 1.7.2. Fixed in versions 1.6.17 and 1.7.2, released July 5, 2026. Approximately 28,410 Roundcube instances are detectable on Shodan across affected version strings.

Why should TPRM professionals care?

Roundcube is commonly deployed as the internet-facing webmail interface for organizations that self-host email infrastructure, particularly in shared hosting environments, academic institutions, government agencies, and smaller enterprises. Its ~28,410 internet-accessible detectable instances make it a large exposed population. A zero-click XSS that requires only email delivery to trigger JavaScript execution in an authenticated mailbox session has a very low operational barrier: the attacker needs only the target's email address and a running Roundcube instance, both trivially discoverable. Roundcube's history as a target for advanced threat actors — particularly APT28/Fancy Bear, which has previously exploited Roundcube XSS vulnerabilities in targeted campaigns against government organizations — gives this vulnerability class elevated threat actor relevance. For TPRM professionals, any vendor using Roundcube as a webmail interface should be confirmed as running 1.6.17 or 1.7.2 given the large exposure population and established threat actor interest in this attack surface.

What questions should TPRM professionals ask vendors?

1. Has Roundcube Webmail been upgraded to version 1.6.17 (1.6.x series) or 1.7.2 (1.7.x series) — the security releases addressing CVE-2026-54433 published July 5, 2026?

2. Is Roundcube deployed as the primary internet-facing webmail interface? If so, what additional authentication controls (MFA, IP restriction, conditional access) are in place to reduce the accessible user population for email-delivered XSS attacks?

3. Have Roundcube user accounts — particularly high-privilege accounts such as administrators and executives — been audited for anomalous mail forwarding rules, unexpected session activity, or modified account settings that may indicate prior XSS exploitation?

4. Is the Roundcube deployment on a supported version branch (1.6.x or 1.7.x)? Older branches (1.5.x and earlier) receive limited security support and may carry additional unpatched vulnerabilities.

Remediation recommendations

Upgrade Roundcube to version 1.6.17 (for 1.6.x deployments) or 1.7.2 (for 1.7.x deployments) immediately. These releases, published July 5, 2026, are the only versions addressing CVE-2026-54433.
Enforce Content Security Policy (CSP) headers on the Roundcube web application as a defense-in-depth measure to restrict JavaScript execution contexts, mitigating the impact of any undetected XSS vulnerabilities.
Review Roundcube user accounts for anomalous forwarding rules, contact exports, or session activity — particularly for high-value accounts. Even without confirmed exploitation, the zero-click delivery mechanism warrants a precautionary audit for any deployment that received external email during the exposure window.
Ensure Roundcube is running a supported major version branch (1.6.x or 1.7.x). End-of-life branches receive no security patches and accumulate unaddressed vulnerability exposure.

Black Kite's Roundcube - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

FreeBSD - Jul2026 (CVE-2026-49418, CVE-2026-49419, CVE-2026-49415)

What is this vulnerability?

Three high-severity local privilege escalation vulnerabilities — CVE-2026-49418, CVE-2026-49419, and CVE-2026-49415 — were disclosed by the FreeBSD Project in a coordinated advisory release on June 30, 2026. All three carry a CVSSv3 score of 7.8 and share a common prerequisite: local, unprivileged user access. No workarounds exist for any of the three flaws; kernel patching and reboot is the only remediation. CVE-2026-49418 and CVE-2026-49415 affect all supported FreeBSD releases; CVE-2026-49419 is specific to FreeBSD 15.0 and later.

CVE-2026-49418 is a use-after-free vulnerability in FreeBSD's virtual memory subsystem. It is triggered through the standard msync() system call with MS_INVALIDATE on a device mapping — a code path available to any unprivileged user. The use-after-free in the device pager can be leveraged for local privilege escalation to root. CVE-2026-49415 is a Time-of-Check Time-of-Use (TOCTOU) race condition during execve() execution of SUID binaries. The race window between address space installation and credential elevation allows same-user process memory manipulation before privileges are elevated, enabling a path to root through the SUID execution mechanism available on any multi-user FreeBSD system. CVE-2026-49419 affects only FreeBSD 15.0 and later and involves a jail reference count underflow in the error path of a jail descriptor lookup. The resulting double-release of a prison structure creates a use-after-free that can elevate privileges inside a jail environment — a critical boundary violation in jail-based container deployments. Notably, the discovery of CVE-2026-49419 was assisted by the GLM-5.1 AI model used by a Tsinghua University research team, representing an emerging trend of AI-assisted kernel vulnerability discovery. No public PoC or active exploitation has been reported for any of the three CVEs.

Why should TPRM professionals care?

FreeBSD is deployed as the OS foundation for network appliances, storage systems, firewalls, cloud hosting platforms, and content delivery infrastructure — environments where a path from local user access to root carries significant operational consequences. Many FreeBSD deployments are multi-user or multi-tenant environments where the boundary between tenant access and root is critical. CVE-2026-49415's TOCTOU in SUID execve is particularly notable: SUID binary execution is a universally available code path on any multi-user FreeBSD system, and the SUID-to-root exploitation class is well-established and historically reliable. CVE-2026-49418's use-after-free in the VM subsystem via msync() — a standard syscall — follows a kernel bug class with a strong track record of weaponization. For TPRM professionals, FreeBSD deployments underpinning network or storage infrastructure should be confirmed as running patched kernels, with particular attention to managed hosting, CDN, and firewall appliance vendors whose FreeBSD foundation may not be visible in standard technology disclosures.

What questions should TPRM professionals ask vendors?

1. Have FreeBSD kernel patches for CVE-2026-49418, CVE-2026-49419, and CVE-2026-49415 been applied across all FreeBSD-based systems and appliances? Kernel patching requires a system reboot to take effect — has the reboot been confirmed on all affected hosts?

2. For FreeBSD 15.0 deployments (CVE-2026-49419): are jail environments in use? If so, have jail configurations been audited post-patch to verify that jail boundary integrity is maintained? The use-after-free in jail descriptor handling specifically targets privilege escalation within jail contexts.

3. Do FreeBSD deployments host multi-user or multi-tenant environments where local access by unprivileged users is standard? If so, the urgency of patching CVE-2026-49415 (SUID TOCTOU) and CVE-2026-49418 (VM use-after-free) is elevated, as both require only standard unprivileged local access to exploit.

4. Are FreeBSD-based network appliances or storage systems running vendor-supplied firmware that incorporates FreeBSD? If so, what is the firmware vendor's patch timeline for addressing these kernel vulnerabilities, and is there a mechanism to apply OS-level security patches independent of full firmware updates?

Remediation recommendations

Apply FreeBSD security patches for CVE-2026-49418, CVE-2026-49419, and CVE-2026-49415 from the FreeBSD Security Advisories page and reboot all affected hosts. No workarounds exist — kernel patching and reboot is the only remediation for all three CVEs.
For FreeBSD 15.0+ deployments using jail environments: audit jail configurations post-patch and verify that the jail descriptor reference counting fix (CVE-2026-49419) has eliminated the use-after-free path. Ensure jail-to-host privilege boundaries are intact.
For appliances and embedded FreeBSD systems where kernel patches cannot be applied independently: contact the appliance vendor for firmware updates that incorporate the patched FreeBSD kernel, and implement network-level access controls to restrict local user access to affected systems during the patch lag window.
Monitor the FreeBSD Security Advisories page (freebsd.org/security/advisories/) for additional patches and any updated exploitation assessment for these CVEs — the AI-assisted discovery of CVE-2026-49419 indicates an accelerating pace of kernel vulnerability research that may produce follow-on findings.

Black Kite's FreeBSD - Jul2026 FocusTag® details critical insights on the event for TPRM professionals.

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

This week's seven FocusTags® span the full spectrum of enterprise infrastructure risk categories — from SSL VPN perimeter gateways and file transfer platforms to database servers, email platforms, webmail applications, and OS kernels. The portfolio illustrates a characteristic of the modern enterprise attack surface that TPRM programs must address: the most consequential vulnerabilities this week are not distributed evenly across standard risk categories. SonicWall SMA1000 and Progress ShareFile represent perimeter and file transfer infrastructure — categories historically overrepresented in active exploitation events and large-scale breach incidents. Zimbra and Roundcube represent webmail platforms used by organizations that have not migrated to cloud email — invisible in cloud-centric vendor technology disclosures but carrying zero-click exploitation risk with nation-state threat actor relevance. FreeBSD represents OS-level infrastructure exposure that standard technology questionnaires structurally cannot capture.

Black Kite's FocusTags® address this structural gap by combining external signal detection — Shodan fingerprinting, certificate analysis, HTTP banner matching — with vulnerability intelligence to identify vendor exposure before vendors self-disclose it. The SonicWall SMA1000 tag's build-level specificity (distinguishing vulnerable from patched hotfix builds sharing the same version string) and the ShareFile SZC tag's product-based detection ahead of CVE publication demonstrate the operational value of tagging that does not wait for complete vulnerability metadata to initiate vendor engagement. The SharePoint tag expansion this week further illustrates FocusTag® operational continuity: TPRM teams that initiated SharePoint engagement after the July 3 post can now carry that engagement forward with three additional KEV-listed CVEs without restarting the vendor dialogue.

Strengthening TPRM Outcomes with Black Kite’s FocusTags®

Black Kite's FocusTag® technology provides TPRM teams with the intelligence infrastructure needed to keep pace with an accelerating threat landscape. By automatically correlating newly disclosed vulnerabilities with the technology profiles of vendors in your ecosystem, Black Kite transforms reactive patch tracking into proactive vendor risk management.

Instant Vendor Exposure Mapping: FocusTags® automatically identify which vendors in your portfolio are running affected products — including perimeter gateways, file transfer servers, webmail platforms, and OS-level infrastructure that never appear in self-disclosed technology inventories.
Precision-Targeted Remediation Requests: Each FocusTag® includes specific, technically grounded vendor questions — moving beyond generic patch status inquiries to build-level, IoC-verification, and forensic-confirmation questions that surface genuine remediation status.
Continuous Risk Score Integration: FocusTag® exposure feeds directly into Black Kite's vendor risk scores, ensuring that critical vulnerability exposure is immediately reflected in third-party risk ratings without waiting for the next scheduled assessment cycle.
Operational Efficiency at Scale: By consolidating multi-product vulnerability intelligence — including Patch Tuesday batch disclosures and zero-day events — into a single prioritized view, FocusTags® enable TPRM teams to manage concurrent threat events across diverse technology categories without scaling headcount.

About Focus Friday

Every week, we delve into the realms of critical vulnerabilities and their implications from a Third-Party Risk Management (TPRM) perspective. This series is dedicated to shedding light on pressing cybersecurity threats, offering in-depth analyses, and providing actionable insights.

FocusTags® in the Last 30 Days

Progress ShareFile SZC : CVE Pending, Authenticated Path Traversal Vulnerability Allowing Arbitrary File Read, Arbitrary File Write, and Directory Enumeration in Progress ShareFile Storage Zone Controller.
SonicWall SMA1000 - Jul2026 : CVE-2026-15409, CVE-2026-15410, Unauthenticated Server-Side Request Forgery Vulnerability and Post-Authentication Code Injection Vulnerability in SonicWall SMA1000.
MSSQL - Jul2026 : CVE-2026-42990, CVE-2026-54117, CVE-2026-54118, CVE-2026-47295, CVE-2026-54116, CVE-2026-50468, Heap-Based Buffer Overflow Vulnerability, Deserialization of Untrusted Data Vulnerabilities, SQL Injection Vulnerability, and Information Disclosure Vulnerabilities in Microsoft SQL Server.
Exchange Server - Jul2026 : CVE-2026-55008, CVE-2026-55005, CVE-2026-55009, CVE-2026-55006, Cross-Site Scripting Vulnerability, Heap-Based Buffer Overflow Vulnerability, Deserialization of Untrusted Data Vulnerability, and Privilege Escalation Vulnerability in Microsoft Exchange Server.
Zimbra - Jul2026 : No CVE, Stored Cross-Site Scripting Vulnerability in Zimbra Collaboration Suite Classic Web Client.
Roundcube - Jul2026 : CVE-2026-54433, Zero-Click Stored Cross-Site Scripting Vulnerability in Roundcube Webmail.
FreeBSD - Jul2026 : CVE-2026-49418, CVE-2026-49419, CVE-2026-49415, Use-After-Free Vulnerability, Jail Reference Count Underflow Vulnerability, and Time-of-Check Time-of-Use Race Condition Vulnerability in FreeBSD.
JoomShaper SP Page Builder : CVE-2026-48908, Critical Unauthenticated Remote Code Execution Vulnerability in JoomShaper SP Page Builder.
Langflow - CVE-2026-55255 : CVE-2026-55255, High-Severity Insecure Direct Object Reference Vulnerability in Langflow.
ActiveMQ - Jul2026 : CVE-2026-53916, CVE-2026-50734, CVE-2026-50750, CVE-2026-49432, CVE-2026-54475, CVE-2026-49877, CVE-2026-49434, CVE-2026-53917, CVE-2026-52760, Multiple Apache ActiveMQ Vulnerabilities.
SharePoint - CVE-2026-45659 : CVE-2026-45659, High-Severity Deserialization of Untrusted Data Vulnerability in Microsoft SharePoint List Item Update Workflow Allowing Low-Privilege Network Remote Code Execution.
ProFTPD : CVE-2026-35025, High-Severity ACL Bypass Vulnerability in ProFTPD via /proc/self/root RNFR Path Prefix Allowing Authenticated Access to Restricted Directories.
Cacti - Jun2026 : CVE-2026-39893, CVE-2026-39948, CVE-2026-39955, CVE-2026-39938, Critical Pre-Authentication SQL Injection, Regex Validation Bypass, and Unauthenticated Local File Inclusion Vulnerabilities in Cacti.
Gogs - Jun2026 : CVE-2026-52813, CVE-2026-52806, CVE-2026-52811, Critical Path Traversal, Git Hook Overwrite, Rebase Argument Injection, Arbitrary OS Command Execution, and Symlink File Write Vulnerabilities in Gogs Leading to Remote Code Execution and Persistent Backdoors.
Squidbleed : CVE-2026-47729, CVE-2026-50012, Critical Heap Over-Read Vulnerability in Squid Proxy FTP Directory-Listing Parser Leading to Cleartext HTTP Request and Token Disclosure.
UniFi OS Devices : CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000, CVE-2026-34911, Critical Improper Access Control, Path Traversal, Command Injection, and Information Disclosure Vulnerabilities in UniFi OS Devices.
pgAdmin - Jun2026 : CVE-2026-12046, CVE-2026-12045, CVE-2026-12048, Critical Unauthenticated Remote Code Execution, AI Assistant Transaction Bypass, OS Command Execution, and Stored XSS Vulnerabilities in pgAdmin 4.
FreeBSD - Jun2026: CVE-2026-45257, High-Severity Local Privilege Escalation Vulnerability in FreeBSD KTLS sendfile(2) Handling Allowing Page Cache Modification and Root Compromise.
TinyProxy - Jun2026 : CVE-2026-54388, CVE-2026-54387, CVE-2026-55202, Critical HTTP Request Smuggling, CL/TE Desynchronization, Request Injection, Cache Poisoning, Access Control Bypass, and StatHost Bypass Vulnerabilities in TinyProxy.
NGINX Rift Chain : CVE-2026-42945, CVE-2026-46376, Critical Heap-Based Buffer Overflow and Remote Code Execution Vulnerability in NGINX ngx_http_rewrite_module.
FortiBleed Breach : Active exploitation of Fortinet vulnerabilities has led to confirmed breach activity, enabling attackers to compromise exposed Fortinet environments and creating significant third-party risk for affected organizations.
Langflow - Jun2026 (Latest) : CVE-2026-5027, High-Severity Path Traversal and Unauthenticated Remote Code Execution Vulnerability in Langflow.
Jenkins - Jun2026 : CVE-2026-53435, CVE-2026-53441, High-Severity Deserialization Type Bypass, User Impersonation, Arbitrary File Read, Script Console Remote Code Execution, and Stored XSS Vulnerabilities in Jenkins.

See Black Kite's full CVE Database and the critical TPRM vulnerabilities that have an applied FocusTags® at https://blackkite.com/cve-database.

References

https://blackkite.com/blog/sharefiles-silent-zero-day-inside-progresss-emergency-storage-zone-controller-shutdown

FOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in Progress ShareFile SZC, SonicWall SMA1000, MSSQL, Exchange Server, Zimbra, Roundcube, FreeBSD, and SharePoint

Published

Authors

Contributors

In this article

In this article

See Black Kite in action

Introduction

Progress ShareFile SZC

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

SharePoint - Jul2026 FocusTag® Update

SonicWall SMA1000 - Jul2026 (CVE-2026-15409, CVE-2026-15410)

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

MSSQL - Jul2026 (CVE-2026-42990, CVE-2026-54117, CVE-2026-54118, CVE-2026-47295, CVE-2026-54116, CVE-2026-50468, CVE-2026-47296, CVE-2026-55002)

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

Exchange Server - Jul2026 (CVE-2026-55008, CVE-2026-55005, CVE-2026-55006, CVE-2026-55009)

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

Zimbra - Jul2026

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

Roundcube - Jul2026 (CVE-2026-54433)

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

FreeBSD - Jul2026 (CVE-2026-49418, CVE-2026-49419, CVE-2026-49415)

What is this vulnerability?

Why should TPRM professionals care?

What questions should TPRM professionals ask vendors?

Remediation recommendations

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

Strengthening TPRM Outcomes with Black Kite’s FocusTags®

About Focus Friday

FocusTags® in the Last 30 Days

References