Recorded Future Identifies 85 High-Impact Vulnerabilities in July, Many Actively Exploited

Summary

Recorded Future identified 85 high-impact vulnerabilities in July 2026; 81 were actively exploited or operationally weaponized. The report highlights exploitation across IoT, email, and enterprise systems, with 57 flaws enabling remote code execution.

Key points

• The report identified 85 high-impact vulnerabilities across 61 vendors; 36 received a Very Critical risk score, a 44% increase from the previous month.
• Of the 85 vulnerabilities, 26 appeared in CISA’s Known Exploited Vulnerabilities catalog, 55 were reported by vendors, and four were primarily surfaced through honeypot data.
• The report lists 81 vulnerabilities as actively exploited or operationally weaponized in July; 57 of the 85 vulnerabilities enabled remote code execution.
• Recorded Future identified public proof-of-concept exploits or scanners for 60 vulnerabilities. The cited PoCs were not tested for accuracy or efficacy.
• The Dysphoria botnet exploited known flaws and weak Telnet or SSH credentials in embedded devices to build DDoS and relay infrastructure; UAT-7810 exploited Ruckus devices to expand a relay network.
• Other reported campaigns abused vulnerabilities in Office documents, Roundcube, Zimbra, and Exchange for espionage or payload delivery, while Armored Likho used a malicious Windows shortcut to deploy BusySnake Stealer.
• Fourteen vulnerabilities were at least five years old, and the fastest observed time from public disclosure to reported exploitation was under one day.

CVE

Threat Actors

Malware

Vendors

Products

Tools

Countries

Related Articles

• Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively ExploitedCVE-2021-29441 · CVE-2021-3156 · CVE-2025-49113
• Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively ExploitedCVE-2021-27137 · CVE-2025-55182 · CVE-2026-12569
• Datadog Tracks AI-Assisted Credential-Harvesting Platforms and AWS AbuseCVE-2025-55182 · CVE-2026-48907 · CVE-2026-60137
• Unattended Hermes AI Agent Used in Targeting of Thailand Finance Ministry, Researchers FindCVE-2017-7269 · CVE-2021-3156 · CVE-2021-4034
• Trojanized PoCs Target Vulnerability Researchers with ChocoPoC Python RATCVE-2025-55182 · CVE-2026-0257 · CVE-2026-48908