Junglewise

Weekly report · exploited in the wild

Newly exploited vulnerabilities: week of 13 to 19 July 2026 (week 29)

Final report, published . It does not change.

In the week of 13 to 19 July 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was Fortinet FortiSandbox (2), followed by Fortinet FortiSandbox PaaS (2) and Microsoft SharePoint Enterprise Server 2016 (2).

Newly exploited
10
Critical
10
Technologies hit
15

Newly exploited this week

Technologies hit most

  1. 1.Fortinet FortiSandbox2 vulnerabilities
  2. 2.Fortinet FortiSandbox PaaS2 vulnerabilities
  3. 3.Microsoft SharePoint Enterprise Server 20162 vulnerabilities
  4. 4.Microsoft SharePoint Server 20192 vulnerabilities
  5. 5.Microsoft SharePoint Server Subscription Edition2 vulnerabilities
  6. 6.SonicWall SMA 1000 Series2 vulnerabilities
  7. 7.SonicWall SMA1000 Appliances2 vulnerabilities
  8. 8.Cisco 871 Integrated Services Router1 vulnerability
  9. 9.Cisco IOS1 vulnerability
  10. 10.Fortinet FortiSandbox Cloud1 vulnerability
  11. 11.Knx Association KNX Protocol1 vulnerability
  12. 12.Knx Association Knx Protocol Connection Authorization Option 11 vulnerability
  13. 13.Microsoft Active Directory Federation Services1 vulnerability
  14. 14.Microsoft SharePoint1 vulnerability
  15. 15.Microsoft Sharepoint-Server1 vulnerability

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/exploited/2026-07-13.json, and this page as text at https://junglewise.ai/threats/exploited/2026-07-13.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 13 to 19 July 2026 (week 29)", https://junglewise.ai/threats/exploited/2026-07-13, 2 October 2026.