erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: July 13, 2026

2 editorial briefs, 1 known exploited (cisa kev) addition and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE. Self-hosted ServiceNow customers and partners running instances below the listed Australia, Zurich, Yokohama or Brazil patch levels.
  • Check exposure: Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV. Anyone with Cisco routers on IOS 12.4, typically old 800-series branch or small-site routers, especially where the HTTP management interface is enabled or reachable.
  • Do you run any of these? Cisco IOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-16.
  • PyPI: 2 critical advisories (DIRAC). Check with pip-audit (or: pip show <package>).
  • Composer (PHP): 2 critical advisories (kimai/kimai, facturascripts/facturascripts). Check with composer audit.
  • npm: 1 critical advisory (@sap/approuter). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-6875

ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE

ServiceNow-hosted customers were protected in April; the real risk is self-hosted and partner-hosted instances that have not taken the July 13, 2026 patches.

Must act: Self-hosted ServiceNow customers and partners running instances below the listed Australia, Zurich, Yokohama or Brazil patch levels.

Can relax: Customers on ServiceNow-hosted instances, which ServiceNow mitigated within a day of the April 1 report and has since patched.

  1. Confirm whether any instance you run is self-hosted or partner-hosted rather than ServiceNow-hosted
  2. Upgrade self-hosted instances to a fixed patch or family release listed in KB3137947
  3. Restrict internet access to self-hosted instances (VPN or allow-list) until patched

Read the brief →

Check exposure

· Vulnerability · CVE-2008-4128

Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV

Only organizations still running retired IOS 12.4 routers are exposed, but a Russian state unit is using this bug; find those boxes, turn off their web server today and replace them.

Must act: Anyone with Cisco routers on IOS 12.4, typically old 800-series branch or small-site routers, especially where the HTTP management interface is enabled or reachable.

Can relax: Networks with no IOS 12.4 devices; this CVE is scoped to IOS 12.4 and Cisco says the release has been retired since 2016.

  1. Find every device running IOS 12.4: run show version and look for Version 12.4, or query your inventory or NMS.
  2. On each one, disable the web interface with no ip http server and no ip http secure-server, then save the config.
  3. Plan replacement of IOS 12.4 hardware with supported models, as the joint advisory recommends for end-of-life devices.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2008-4128Cisco IOS
Cisco IOS Cross-Site Request Forgery Vulnerability		2026-07-16

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 2

Check: composer audit

PyPI 2

Check: pip-audit (or: pip show <package>)

npm 1

Check: npm audit (or: npm ls <package>)