Critical Vulnerabilities and Active Exploitation, July 2026

Relevant Incidents

Redis and the cluster of vulnerabilities with public PoC

Redis was the most persistent technical case in July. The record brings together several pieces that, taken together, point to a broad risk for Redis OSS, Redis Software, Redis Cloud, and modules such as RedisTimeSeries and RedisBloom. The CGII advisory in Bolivia was especially relevant for the region because it elevated the issue to a local warning, classified the severity as high, and said exploitation can lead to memory corruption and remote code execution in scenarios where the attacker has an authenticated account and specific permissions, especially to use RESTORE or to operate in master-replica replication contexts.

The set of CVEs cited in the material, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23479 and CVE-2026-23631, is not uniform. Some flaws are tied to insecure deserialization, others to use after free, and others to memory corruption in specific modules. That makes remediation harder, because identifying one vulnerable version is not enough. The main branch, modules, replication policies, and exposure of administrative commands all need review. The Bolivian advisory even calls out specific RedisTimeSeries and RedisBloom versions, extending the scope beyond the product core.

The other important reading is practical exploitation. SecurityLab reported that proof-of-concept exploit chains achieved remote execution even in versions already patched, such as 6.2.22, 7.4.9 and 8.6.4. The Hacker News and Ingeniería Telemática also pointed to the circulation of authenticated PoCs, while Redis responded with seven additional security releases in a single day, on July 23. That sequence suggests the initial fix process did not close off the full attack surface. For a CISO, that means an emergency patch is not the end of the job, it is the start of broader verification of coverage and exposure.

Operationally, Redis deserves a two-layer reading. First, because it is widely used for caches, queues, sessions, and temporary data, which makes it a component with broad horizontal exposure. Second, because the material shows that abuse requires authentication in several scenarios, which changes the control profile. This is not a case of a simple indiscriminate internet scan in all instances, but a vulnerability that can go unnoticed if there is any prior access vector or reused credentials. That raises the importance of reviewing service accounts, segmentation, and command permissions.

SharePoint and pressure on internal collaboration

SharePoint returned to the center of the regional conversation through alert 65/2026 from CTIR Gov in Brazil. The notice identifies vulnerable versions in SharePoint Server 2016, 2019 and Subscription Edition, and adds that the flaw can affect confidentiality, integrity and availability. It also includes an EPSS of 5,06% and a 91,41% percentile, along with a reference to CISA's KEV catalog. That combination matters because it shows the issue was not framed as a simple lab vulnerability, but as a case with enough likelihood of abuse to justify immediate remediation.

Other sources from the same period add technical depth. They mentioned possible theft of machine keys, persistence and unauthenticated remote execution. The appearance of a public proof-of-concept was also cited as a factor accelerating exploitation. All of this places SharePoint in a sensitive spot, not only as a productivity app, but as a piece that often stores sensitive content, integrates authentication, and serves as an interface between users, processes and internal repositories. When a critical vulnerability appears at that point, the potential damage goes beyond a single server.

The regional implication is significant because SharePoint is present in governments, education, financial services and large Latin American corporations. The Brazilian alert also came with concrete recommendations to inventory versions and apply vendor fixes. There is no room here for purely perimeter-based defense. If the system is used as a collaboration portal, the priority should include account review, checks for signs of persistence, and searches for anomalies in logs, since the exploitation described allows access that may survive patching if the response is limited to updating binaries.

OpenSSH, Ivanti, and the perimeter that remains an entry point

Chile provided several high-value operational signals. CSIRT published an advisory on the critical CVE-2024-6387 in OpenSSH, known as regressh, and said confirmed active exploitation exists. It also issued an alert on Ivanti with multiple CVEs, including CVE-2023-46805 and CVE-2024-21887, which, according to the notice itself, were used in combination to compromise Ivanti Connect Secure devices. That combination is important because it marks two distinct but connected realities, exposed remote access and security devices turned into intrusion vectors.

The fact that Ivanti is treated as an active exploitation target in campaigns against security devices underscores a persistent trend in the region, where equipment installed for protection ends up becoming part of the attack surface. This is not a minor detail. If a VPN or access gateway is compromised, the attacker no longer necessarily needs to find an alternate entry path. Instead, they can expand reach, obtain credentials, or move laterally from a point organizations usually consider trusted.

CERT.br added to that reading from Brazil, warning that CVE-2024-24919 in Check Point VPN devices was being used to read sensitive information from the memory of affected gateways. The notice also highlighted reports of compromise in Brazilian organizations and the need to apply vendor patches immediately. When several regional authorities agree that exploitation is happening and the vector touches access infrastructure, the priority stops being theoretical. It becomes a continuity and exposure management issue.

Balbooa Forms and the quiet risk of web extensions

Balbooa Forms for Joomla drew an unusual amount of technical coverage for a third-party extension. The official CVE-2026-56291 record says all versions earlier than 2.4.1 were vulnerable to an unauthenticated arbitrary file upload that allowed executable uploads and full RCE. The technical material adds more troubling details, including the lack of a CSRF token, the absence of an allowlist for extensions, and reliance on the user-provided filename. In other words, the flaw was not subtle. It was a combination of missing controls at a highly exposed entry point.

The problem grows because several sources agree there was active exploitation. CTI Pilot and SentinelOne described the case as a zero-day already being exploited, while Devel Group said CISA added it to the KEV catalog and recommended isolation, immediate patching and threat hunting in HTTP POST logs toward Joomla extension paths. TechConsulting added a useful technical reading by summarizing that the frontend upload handler accepted files without authentication and allowed .php uploads to a public directory. The defensive counterpart is clear, any site that ran the vulnerable extension should be treated as potentially compromised until proven otherwise.

The regional significance of the finding does not depend on a specific victim. It depends on Joomla's wide use in portals, intranets and citizen-facing sites across Latin America, where third-party extensions are often installed to quickly meet business needs. The risk is not just in the CMS, but in the long tail of add-on components that do not always go through the same secure development controls as the core. The month showed that this neglect can end in web shells, persistence and full server compromise in a matter of seconds.

JCE in Brazil and the file that confirms active exploitation

The Joomla Content Editor case, identified as CVE-2026-48907, appears in the archive with an editorial particularity, a Brazilian government source confirmed it as an alert about active exploitation, but the associated date remained unconfirmed in one of the archived records. Even so, the rest of the material for the period places the issue clearly. SonicWall describes it as unauthenticated remote RCE, IntelSecLab published a PoC for the vector through profiles.import, and dbugs, linked to Positive Technologies, presented it as a flawed access control issue that allowed unauthenticated users to create editor profiles and execute arbitrary PHP.

What stands out here is the convergence between the technical detail and the institutional response. This was not just a theoretical vulnerability, it was a flaw that had already prompted a public alert and practical research activity. For security teams, that means checking not only the component version, but also the presence of anomalously created profiles, strange PHP files, and any trace of abuse in import paths. When the vulnerable point is a content editor, compromise can go unnoticed for some time if monitoring is limited to the CMS core.

Active Threats and Campaigns

Ransomware and Extortion

This month’s file includes four cases where ransomware or extortion is the main focus, but only one clearly confirms encrypted assets. In the other three, the material does not specify whether there was encryption, exfiltration without encryption, or only a claim on a leak site. That distinction matters. For a response team, it changes containment priorities, the kind of legal negotiation involved, and how urgently recovery from backups must happen.

A careful reading means not forcing uniformity where none exists. When the source does not confirm encryption, the report should say so. The lack of documentary precision does not reduce the risk, but it does prevent a generic mention from being turned into a verified operational incident. In the month under review, the value of the material lay less in the extortion narrative and more in the initial access vectors that, in practice, often feed these campaigns later.

Fraud and Phishing

The period’s material documents two fraud or phishing cases. There is not enough detail to build a unified campaign or attribute a common method, so the record has to stay at that level. The signal is still useful, because it overlaps with the rest of the risk surface and suggests that credential abuse, impersonation, or social engineering remained a complementary layer for access or monetization.

In a month so heavy with critical vulnerabilities, phishing does not disappear. It becomes the lubricant for other attacks, especially when a stolen credential, a compromised account, or a deceptive interaction lets an attacker get past controls that a vulnerability alone might not have broken. So even though the material does not describe a larger campaign, the data should be read as a reminder that technical exposure and human exposure reinforce each other.

APT and Hacktivism

There is not enough material in this file to build a strong attribution of APT or hacktivism as the month’s dominant themes. There are, however, patterns consistent with actors seeking persistent access or lateral movement through perimeter software and collaboration platforms. The reference to active exploitation in VPNs, SharePoint and OpenSSH aligns with high-value initial access tactics, but the material does not support attribution to specific groups in this section.

Critical vulnerabilities

The table reflects 48 critical CVEs mentioned in the source material, but not all are broken out here because the file groups repeated references and advisories together. What matters most for the region is that several of the highest-impact CVEs were concentrated in remote access, collaboration, and web extension components. That matches a familiar defensive pattern, attackers favor the pieces that handle authentication, visibility, or external publishing, because a single flaw in those layers offers far greater returns than an isolated vector on an internal endpoint.

Regulation and Compliance

No documented regulatory moves were recorded in the month’s material. That does not mean compliance activity has stopped, only that the file contained no verifiable facts to describe new regulatory frameworks, sanctions, or specific compliance obligations for July 2026.

Even without formal regulatory changes, there are still operational compliance implications. CTIR Gov notices in Brazil, along with CERT.br and CSIRT Chile, serve as urgency signals for public and private entities that manage critical infrastructure or essential services. In practice, these advisories often lead to internal requirements for review, asset inventory, patching evidence, and, in some cases, notice to third parties or contractors. The issue is not regulatory in the strict sense, but risk governance.

Latin America’s most affected countries

Brazil

Brazil recorded the highest density of verifiable events during the period. CTIR Gov published alert 65/2026 on Microsoft SharePoint, including affected versions, EPSS, and a KEV reference. CERT.br issued an alert on active exploitation in enterprise VPNs, focused on CVE-2024-24919 and real compromise in Brazilian organizations. Local media also reported incidents tied to Check Point, and the CSIRT of Chile logged an Ivanti alert, which is also relevant for environments with shared regional operations from Brazil.

The Brazilian case reflects a common pattern in Latin American risk, heavy reliance on corporate suites and perimeter devices, plus an institutional sense of urgency that arrives just as the patch is already circulating across the global ecosystem. The quality of the official material is high and points to significant defensive pressure on service companies, critical infrastructure, and public-sector organizations. In practical terms, Brazil concentrated both alert production and regional media amplification.

Chile

Chile was the second major source of documentation during the month because of its CSIRT activity. The agency published an alert on OpenSSH with confirmed active exploitation, another on Ivanti vulnerabilities, and a reference to actively exploited perimeter devices. Chile’s presence in the archive is notable because it shows a national authority addressing remote access and perimeter vulnerabilities with an operational lens, not just an informational one.

The Chilean signal is clear: external exposure gets priority, access devices are reviewed, and patches are applied immediately. That suggests an environment where perimeter failures remain a real concern for organizations with distributed operations, connected vendors, and remote users. The lack of other mentions should not be read as lower risk, only as a lower density of verifiable facts in the archived material.

Bolivia

Bolivia contributed one of the month’s most detailed technical advisories through the CGII. The agency issued a warning about a set of Redis vulnerabilities, with a high severity classification, affected versions, and a technical explanation of the exploitation mechanisms. Beyond its local value, the document matters regionally because it turns a global issue into a concrete recommendation for administrators in the area.

Bolivia’s contribution shows that national alerts can be as useful as vendor advisories, especially when they spell out modules, versions, and mitigation steps. In environments where Redis is used as a high-performance internal service, the risk is not only public exposure but also persistent replication settings or overly broad permissions. In that sense, Bolivia was a strong example of operationalizing risk.

Colombia

Colombia did not record incidents with confirmed impact in the core of this report, but it did contribute aggregated telemetry through ColCERT. The alert on the CHARLIE/ORB3/SPACEHOP network reported at least 16 confirmed nodes carrying out large-scale scanning and brute-force activity against SSH, PostgreSQL, and Apache Tomcat. That data is not counted as an incident, but it does help show that Colombian organizations operate in an environment with constant automated pressure.

Colombia’s July profile is therefore one of exposure to mass noise rather than a single standalone case. The editorial value of the data is contextual and should not be confused with confirmed impact. Even so, scans at this scale show that access controls and service exposure remain basic hygiene priorities.

Mexico

The month’s material did not include verifiable facts that would allow Mexico to be assigned a concrete incident or alert within this axis. That does not reduce the country’s risk, but it does limit what can be documented. The archive does not include a Mexican alert comparable to those from Brazil, Chile, or Bolivia for July 2026.

Argentina

No verifiable facts were recorded for Argentina in this axis during the period. The absence of material should not be read as the absence of exposure, only as the lack of documented cases in the available archive.

Peru

No verifiable facts were recorded for Peru in this axis during the period. The material reviewed does not provide a concrete alert or incident dated July 2026.

Paraguay

No verifiable facts were recorded for Paraguay in this axis during the period. The archive also does not contain a comparable advisory that would support a country-specific assessment.

United States

Although this report prioritizes Latin America, several events during the period frame regional exposure because they involve global vendors and known exploit catalogs. In particular, CISA added SharePoint to KEV, and the Balbooa Forms case is also referenced. These are not Latin American incidents in themselves, but they do shape how quickly teams in the region need to respond.

Trends and signals to monitor

There is no month-over-month comparison baseline in this archived format for Latin America, so it would be wrong to invent percentage changes or a quantified trend from one month to the next. What July did show was a clear pattern of pressure across three fronts, perimeter exposure, internal collaboration, and web extensions. Redis, SharePoint, VPNs, OpenSSH, Ivanti, JCE, and Balbooa Forms make up a software chain that mixes access, authentication, publishing, and administration. That mix is highly valuable to intruders because it can let them move from an external flaw to persistence or lateral movement at relatively low cost.

A second signal to monitor is the acceleration between PoC and effective mitigation. The material shows cases where public exploitation was already underway, KEV catalogs, regional CERT advisories, and multiple vendor patch rounds. When that happens, the question is no longer whether the vulnerability is serious, but whether the organization closed the gap before it was exploited in its environment. That shift in the question, from abstract severity to remediation speed, is probably the month’s most important trend.

The third signal is the persistence of vulnerabilities in products that are often managed by different teams. Redis may sit with data platforms, SharePoint with workplace or collaboration teams, VPNs and gateways with infrastructure or security, Joomla with web or marketing, Ivanti with operations or security. Risk appears when no one has the full picture. July left the impression that fragmented ownership remains a more serious regional weakness than the lack of patches itself.

Security team recommendations

First, build or update an exposure inventory that goes beyond core software. This month showed that Redis modules, Joomla extensions, and add-ons such as Balbooa Forms can have as much impact as a flaw in the main product. The inventory should include branches, plugins, modules, minor versions, and exposed admin points.

Second, prioritize patch validation with real verification, not just closed tickets. Several cases this month show that an initial fix did not necessarily close the full attack surface. It is worth checking versions, endpoint behavior, and signs of exploitation, especially in Redis, SharePoint, VPNs, and Joomla. If the vendor issued several security rounds within a few days, assume the first remediation may have been incomplete or insufficient for the local installation.

Third, urgently review remote access services and edge devices. OpenSSH, Ivanti, and Check Point were confirmed under active exploitation. That means looking for anomalies in authentications, persistent sessions, new accounts, altered rules, and any sign of lateral movement after the initial entry. On security devices, the audit should also include configuration, logs, and the possibility of compromise before patching.

Fourth, treat SharePoint and other collaboration platforms as high-sensitivity assets. Exposure of machine keys, the possibility of persistence, and the impact on confidentiality and integrity require more than a patch. Credentials, keys, associated services, and signs of abuse need to be reviewed. If the platform serves as a business portal or intranet, the potential damage expands to entire processes.

Fifth, apply specific hardening to web applications and CMS extensions. The Balbooa Forms case is a direct example of why forms, upload handlers, and import endpoints must be secured. Temporarily disabling critical components, restricting by IP where possible, blocking PHP execution in upload directories, and reviewing HTTP POST logs are reasonable measures when the time between disclosure and abuse is short.

Sixth, assume compromise when the scenario warrants it. If a Joomla site ran vulnerable Balbooa Forms, or if a SharePoint instance was exposed with the July CVE, updating is not enough. Teams need to review accounts, look for web shells, rotate credentials, validate backups, and analyze events from before remediation. The logic in July was not isolated patching, but persistence hunting.

Seventh, coordinate security, infrastructure, and application owners. This month made clear that organizational fragmentation worsens risk. Redis, SharePoint, VPNs, and CMS platforms often have different owners, but attackers do not respect those boundaries. Prioritization should be cross-functional and on short timelines.

Material limitations

This report was prepared exclusively from the material provided for July 2026, without internet access and without adding sources outside the authorized list. The scope is Latin America, although several facts from global vendors or outside organizations were used only when they helped frame risks that did have regional impact or triggered alerts.

The time window for the indicators is the one stated at the beginning: 189 facts dated in July 2026, 14 from earlier months as a comparative frame, and 1 fact without a confirmed date, excluded from the indicators. Facts from earlier months do not count toward the period volume and may only be cited if their month is made explicit. The record without a confirmed date is also excluded from the counts, and when it is used as context, it must be stated that the date is not confirmed.

The indicator for critical CVEs mentioned should not be confused with a lack of vulnerabilities in the region if any section appears at zero in another period. This month, the material did record critical CVEs, but the methodological principle remains the same, a zero value would mean only that none appeared in the material reviewed, not that no real activity existed in the region.

Aggregate telemetry was not added to incidents either. ColCERT and Semana records are cited only as attempts, blocks, or volume measurements, not as intrusions with confirmed impact. Likewise, ransomware or extortion cases were kept distinct according to the available evidence, and when the source did not allow a determination of whether assets were encrypted, that was stated explicitly. Social media and excluded content were not used, and trends were not based on promotional material.

Finally, some items in the file have inconsistent dates or records without complete time confirmation. In those cases, the priority was not to force an artificial chronology. The goal was to preserve traceability and avoid turning a technically interesting fact into a claim that the material did not support.