KEV Intelligence Brief — July 8, 2026

Issued: Wednesday, July 8, 2026 Audience: Federal contractors, DevOps/platform teams, security operations leaders Scope: 8 KEV additions spanning June 25 – July 7, 2026

Three patch deadlines in this batch have already passed. Two more expire in 48 hours. If your organization runs any of the affected products and has not confirmed remediation, stop reading and start patching.

Deadline Watch: Overdue and Expiring in 48 Hours

Four vulnerabilities in this batch carry deadlines that are either past or critically imminent, and the combination of affected products should command immediate leadership attention.

Microsoft SharePoint Server (CVE-2026-45659) — deadline July 4, now four days overdue — exposes a deserialization of untrusted data vulnerability that enables authenticated network code execution. Deserialization flaws in SharePoint have historically been weaponized for lateral movement and credential harvesting within enterprise environments. "Authenticated" does not mean low risk here; threat actors routinely obtain valid credentials through phishing or prior compromises before pivoting to exploitation. Any SharePoint Server instance that has not received the relevant patch should be treated as potentially compromised. Pull authentication logs, review service account activity, and apply CISA's Forensics Triage Requirements before simply patching and moving on.

SimpleHelp (CVE-2026-48558) — deadline July 2, six days overdue — is arguably the most operationally dangerous entry in this batch. When OIDC authentication is configured, the platform accepts identity tokens without verifying their cryptographic signatures, allowing an unauthenticated remote attacker to forge a token, impersonate an arbitrary technician, and obtain a fully authenticated session — potentially bypassing MFA entirely. SimpleHelp is remote support software, meaning successful exploitation grants an attacker keyboard-level access to endpoints that technicians routinely service. Organizations should immediately audit active technician sessions for anomalies, rotate all API keys and service credentials associated with the platform, and verify whether OIDC was enabled in their deployment configuration. If patching is not immediately feasible, disable OIDC authentication and restrict access to trusted IP ranges at the network perimeter.

PTC Windchill and FlexPLM (CVE-2026-12569) and Cisco Unified CM (CVE-2026-20230) both carried a June 28 deadline, now ten days past. PTC's improper input validation flaw allows unauthenticated remote code execution via a malformed network request — a critical severity class that should have prompted emergency patching windows in any defense-industrial or manufacturing environment running Windchill or FlexPLM. These platforms manage product lifecycle and supply chain data; their compromise carries intellectual property and operational security implications beyond typical IT incidents. Cisco Unified CM's SSRF vulnerability (CVE-2026-20230) enables unauthenticated file writes to the underlying OS, creating a reliable staging mechanism for privilege escalation to root. Voice and communications infrastructure is frequently underpatched relative to enterprise IT assets; operations teams should validate patch status against all Unified CM and Unified CM SME nodes, including those in telephony DMZs that may be outside standard vulnerability scan scope.