July 22, 2026 is shaping up to be one of the more demanding days of the year for security operations teams. A cluster of critical vulnerabilities spanning enterprise collaboration platforms, widely deployed content management systems, AI workflow tooling, and edge networking hardware are all confirmed under active exploitation. CISA has expanded its Known Exploited Vulnerabilities catalog with four new entries, and watchTowr has flagged in-the-wild abuse of a freshly publicized SharePoint proof-of-concept. The common thread today is speed: attackers are moving from public disclosure to active exploitation faster than many patch cycles allow.

The most severe and immediately pressing issue is CVE-2026-50522, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server carrying a CVSS score of 9.8. Deserialization flaws of this class are particularly dangerous because they allow an attacker to craft malicious serialized objects that, when processed by the server, result in arbitrary remote code execution with the privileges of the SharePoint application pool. With a public proof-of-concept now circulating and active exploitation confirmed by watchTowr, any organization running an unpatched SharePoint Server instance should treat this as an emergency. Microsoft addressed this flaw in the July 2026 Patch Tuesday release, so the patch exists — the race is now purely about deployment speed.

On the web platform front, two separate WordPress Core vulnerabilities have landed in CISA's KEV catalog simultaneously. CVE-2026-60137 is a SQL injection flaw in WordPress Core, enabling attackers to manipulate database queries and potentially extract sensitive data, escalate privileges, or plant backdoors. CVE-2026-63030 is described as an interpretation conflict vulnerability, a class of flaw where ambiguity in how the application processes input can be leveraged to bypass security controls or execute unauthorized actions. The fact that both affect WordPress Core — not just a plugin — means the exposure surface is enormous. WordPress powers a substantial fraction of the public web, and core vulnerabilities are reliably weaponized at scale within days of disclosure.

Langflow, an increasingly popular open-source platform for building AI agent pipelines and large language model workflows, is the subject of CVE-2026-0770. This vulnerability allows inclusion of functionality from untrusted control spheres, which in practical terms means an attacker can inject and execute malicious code or components within the Langflow runtime environment. As AI orchestration tools proliferate across development and production environments, they represent a growing and often under-monitored attack surface. Many Langflow deployments are internet-exposed for convenience, making this flaw particularly attractive to opportunistic threat actors.

Rounding out today's critical landscape is CVE-2021-27137, a stack-based buffer overflow in DD-WRT router firmware. While the CVE identifier dates to 2021, its addition to the KEV catalog today confirms it is being actively exploited right now. DD-WRT is widely deployed on consumer and small-business routers, and compromised edge devices provide attackers with persistent network footholds, traffic interception capability, and pivot points into internal networks. The age of this vulnerability makes its continued exploitation a stark reminder that unmanaged or forgotten network devices remain a persistent liability.

Defensive priorities for security teams today:

- Apply the Microsoft July 2026 Patch Tuesday update to all SharePoint Server instances immediately; prioritize internet-facing and hybrid deployments first and validate patch application through your vulnerability management tooling.
- Enable enhanced logging on SharePoint servers and alert on unusual deserialization activity, unexpected process spawning from the SharePoint application pool, or anomalous outbound connections from SharePoint hosts.
- Update WordPress Core installations to the latest patched release without delay; audit all WordPress sites in your inventory including those managed by third parties or hosted externally, and review database user permissions to limit SQL injection blast radius.
- Audit Langflow deployments across your environment; restrict network access to Langflow instances using firewall rules or zero-trust controls, require authentication on all endpoints, and monitor for unexpected code execution or outbound connections from AI pipeline hosts.
- Conduct an immediate inventory of DD-WRT devices on your network; apply available firmware updates, disable remote management interfaces where not required, and consider replacing end-of-life devices that cannot receive patches.
- Cross-reference your asset inventory against all four new CISA KEV entries and treat any match as a priority-one remediation item in line with BOD 22-01 requirements for federal agencies and as a best-practice benchmark for all others.
- Increase monitoring sensitivity on network egress from edge devices, web servers, and AI tooling hosts for the next 72 hours given the confirmed active exploitation across all of these categories.

The breadth of today's threat landscape — spanning enterprise servers, CMS platforms, emerging AI tooling, and legacy network hardware — underscores that attackers do not limit themselves to a single technology tier. Defense requires visibility and patch discipline across the entire stack.

This briefing is informational and for situational awareness only; always consult official vendor advisories and CISA guidance as the authoritative source for remediation details.