The Lyceum: Cyber Intelligence Daily — Jul 23, 2026

• Patch exposed Langflow immediately: CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog after more than 220 exploitation attempts from 64 source IP addresses were recorded, and Federal Civilian Executive Branch agencies face a July 24 remediation deadline for a flaw that allows unauthenticated command execution as root.
• Hunt through SharePoint, not just around it: CISA confirmed active exploitation of CVE-2026-50522 and set a July 25 federal remediation deadline, but organizations should also review authentication activity, server logs, and unexpected changes for evidence that attackers established persistence before the update.
• Audit trusted control points: Check Point SmartConsole operators should review exposure and access records, while Chrome users should confirm Adobe’s updated Acrobat extension is deployed because privileged management software and browser extensions can turn defensive or productivity tooling into access paths.

Langflow is now an active intrusion path. CISA added CVE-2026-0770 in Langflow to its Known Exploited Vulnerabilities catalog on July 22, confirming that attackers are using the critical AI-agent builder flaw rather than merely demonstrating it. An unauthenticated user can send malicious data to a code-validation endpoint and execute commands as root. Monitoring cited by BleepingComputer recorded more than 220 exploitation attempts from 64 source IP addresses.

Federal Civilian Executive Branch agencies must remediate by July 24. Other Langflow operators should treat that deadline as an immediate exposure marker. Continued activity after the deadline—or Langflow appearing in botnet campaigns, breach reports, or further CISA alerts—would show that the product has become a dependable route into powerful servers.

Patching SharePoint is necessary, but it does not prove the server is clean. CISA added Microsoft SharePoint vulnerability CVE-2026-50522 to the exploited-vulnerability catalog on July 22, identifying deserialization of untrusted data that can lead to remote code execution. The federal remediation deadline is July 25.

Because SharePoint often holds documents, credentials, and access to other Microsoft services, responders should examine authentication activity, server logs, and unexpected changes for persistent access. If Microsoft or incident-response firms connect the vulnerability to named compromises, the operating requirement shifts from emergency vulnerability management to breach containment.

Active exploitation has reached the management plane. CISA also added CVE-2026-16232, an improper-authentication vulnerability in Check Point SmartConsole, placing exploitation close to the systems used to administer Check Point security infrastructure. Public technical detail remains limited, so operators should review exposure and access records while watching for Check Point to publish affected versions, exploitation indicators, and forensic guidance. Evidence that attackers can alter managed security policy could force configuration reconstruction rather than only credential rotation.

The risk extends beyond one vendor. Separately, a July 22 United States government update warned of Iran-linked activity involving operational-technology environments associated with Siemens, Schneider Electric, and Rockwell Automation. That cross-vendor scope points to reachable controllers and weak remote access as the shared opportunity, requiring attention across industrial environments rather than around one defective product.

Browser extensions can turn ordinary web pages into surveillance tools. Adobe updated its Acrobat extension for Google Chrome after Guardio disclosed CVE-2026-48294, dubbed HermeticReader, which allowed a malicious webpage to abuse internal extension messaging and reach WhatsApp Web chat previews, contact names, and profile information without stealing the user’s WhatsApp password. Guardio found no evidence of active exploitation.

Update adoption now determines whether the issue remains a warning about extension privilege or becomes a scalable surveillance opportunity. Any revised exploitation assessment or similar extension-to-web-app disclosure would raise the stakes. In Ukraine, fake course-completion certificates are carrying malware in emails impersonating educational platforms, using an administrative-looking professional credential as the lure. Taiwan’s iThome also reports that Ukraine’s incident-response team linked UAC-0145, associated with Russia’s Main Intelligence Directorate and Sandworm, to ClickFix pages planted on at least ten Ukrainian websites during June and July, where fake CAPTCHAs instruct visitors to paste PowerShell commands into Windows and install the malware themselves.

• If Langflow exploitation continues after the July 24 remediation deadline, it means the AI workflow tool is becoming durable commodity infrastructure for cybercrime rather than a short-lived target of opportunity.
• If SharePoint investigations uncover persistence after patching, it means emergency updates must be paired with retrospective compromise assessments rather than treated as the end of the incident.
• If Check Point shows that CVE-2026-16232 can alter managed security policy, it means affected SmartConsole environments may require configuration reconstruction and cannot rely on credential rotation alone.