Eclypsium Report Prioritizes 61 Infrastructure Advisories
Summary
Eclypsium’s inaugural July 2026 InfraTrust Pulse reviewed 61 infrastructure advisories from 14 vendors, prioritizing exposure and exploitability over CVSS. It highlighted actively exploited SonicWall SMA1000 flaws and Fortinet FortiSandbox issues added to CISA’s KEV.
Key points
- InfraTrust Pulse prioritizes infrastructure, firmware, networking, and edge-device vulnerabilities by exploitability, exposure, and real-world risk—not CVSS alone.
- The July 2026 report tracked 61 advisories from 14 vendors, including six critical advisories and 26 vulnerabilities remotely exploitable without authentication.
- The report highlighted actively exploited SonicWall SMA1000 flaws, CVE-2026-15409 and CVE-2026-15410; the article says attackers used them to install custom malware before disclosure.
- Fortinet FortiSandbox flaws CVE-2026-39808 and CVE-2026-25089 were added to CISA’s KEV catalog on July 16 after exploitation was detected.
- Other prioritized advisories affected Dell networking systems, internet-facing F5 BIG-IP devices, Juniper routers and switches, and NVIDIA BlueField and ConnectX products.
- The report notes that firmware and hardware fixes may lag upstream security fixes; it cites an HP Poly advisory issued four months after an included Qualcomm driver flaw was exploited.
Article Details
- Publisher
- Eclypsium
- Report Period
- July 2026; inaugural InfraTrust Pulse
- Scope
- Infrastructure, firmware, networking, and edge-device security advisories
- Sample Size
- 61 advisories from 14 vendors
- Key Statistics
- The July 2026 report tracked 61 advisories from 14 vendors.
- Six tracked advisories were rated critical.
- The report identified 26 vulnerabilities exploitable remotely without authentication.
- CISA added the two FortiSandbox vulnerabilities CVE-2026-39808 and CVE-2026-25089 to its KEV catalog on July 16, 2026.
- Recommendations
- Prioritize vulnerabilities using exploitability, reachability, exposure, and real-world risk rather than CVSS scores alone.
- Prioritize patching the highlighted internet-exposed or actively exploited infrastructure vulnerabilities.
- Account for delays in firmware and hardware fixes that depend on vendors to integrate and distribute upstream security updates.
MITRE ATT&CK
CVE
CVE-2026-15409In SonicWall’s case, attackers were exploiting the SMA1000 flaws, tracked as CVE-2026-15409 and CVE-2026-15410, to install custom malware weeks before SonicWall disclosed the flaws and before they were added to CISA’sCVE-2026-15410In SonicWall’s case, attackers were exploiting the SMA1000 flaws, tracked as CVE-2026-15409 and CVE-2026-15410, to install custom malware weeks before SonicWall disclosed the flaws and before they were added to CISA’sCVE-2026-21385HP’s Poly Video advisory shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA’s Known Exploited Vulnerabilities (KEV)CVE-2026-25089The Fortinet FortiSandbox advisories (FG-IR-26-100 / FG-IR-26-141) include two older critical command injection vulnerabilities tracked as CVE-2026-39808 and CVE-2026-25089.CVE-2026-39808The Fortinet FortiSandbox advisories (FG-IR-26-100 / FG-IR-26-141) include two older critical command injection vulnerabilities tracked as CVE-2026-39808 and CVE-2026-25089.
Threat Actors
Salt TyphoonThe article says campaigns exploiting vulnerabilities in internet-facing infrastructure have been attributed to state-sponsored hacking groups including Salt Typhoon.Volt TyphoonThe article says campaigns exploiting vulnerabilities in internet-facing infrastructure have been attributed to state-sponsored hacking groups including Volt Typhoon.
Vendors
Dellactively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.F5actively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.Fortinettracked 61 advisories from 14 vendors and highlighted actively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.HPAs an example, HP’s Poly Video advisory shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA’s Known Exploited VulnerabilitiesJuniper Networksexploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.Nvidiaflaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.QualcommAs an example, HP’s Poly Video advisory shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA’s Known Exploited VulnerabilitiesSonicWallJuly 2026 report tracked 61 advisories from 14 vendors and highlighted actively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.
Products
BIG-IPF5 BIG-IPBlueFieldNVIDIA BlueField / ConnectXConnectXNVIDIA BlueField / ConnectXEMC Networking OS10Dell Networking (EMC Networking OS10 / SmartFabric Manager)FortiSandboxadvisories from 14 vendors and highlighted actively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.Junos OSThe Juniper Networks advisory (JSA110083 and JSA110086) addresses remotely exploitable flaws in Junos OS that can crash affected routers and switches, potentially disrupting network availability.Poly VideoAs an example, HP’s Poly Video advisory shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA’s Known Exploited VulnerabilitiesSMA10002026 report tracked 61 advisories from 14 vendors and highlighted actively exploited flaws in SonicWall SMA1000 and Fortinet FortiSandbox, alongside risks affecting Dell, F5, Juniper, and NVIDIA systems.SmartFabric ManagerDell Networking (EMC Networking OS10 / SmartFabric Manager)
Industries
Critical infrastructureexploited flaws in routers, VPNs, firewalls, and other internet-facing infrastructure to breach critical infrastructure and telecommunications providers, including in campaigns attributed to state-sponsored hackingTelecommunicationsVPNs, firewalls, and other internet-facing infrastructure to breach critical infrastructure and telecommunications providers, including in campaigns attributed to state-sponsored hacking groups such as Volt Typhoon