---
title: "Security digest: July 13, 2026"
url: https://erroneo.us/security/2026-07-13/
description: "July 13, 2026 vulnerability digest: 2 briefs (ServiceNow CVE-2026-6875: Pre-Auth Sandbox…); 1 CISA KEV addition (Cisco); 5 critical advisories (PyPI…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-13
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 13, 2026

2 editorial briefs, 1 known exploited (cisa kev) addition and 5 critical advisories.

## Take stock

- Check exposure: ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE . Self-hosted ServiceNow customers and partners running instances below the listed Australia, Zurich, Yokohama or Brazil patch levels.
- Check exposure: Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV . Anyone with Cisco routers on IOS 12.4, typically old 800-series branch or small-site routers, especially where the HTTP management interface is enabled or reachable.
- Do you run any of these? Cisco IOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-16.
- PyPI: 2 critical advisories ( DIRAC ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 2 critical advisories ( kimai/kimai , facturascripts/facturascripts ). Check with composer audit .
- npm: 1 critical advisory ( @sap/approuter ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE](https://erroneo.us/security/briefs/servicenow-cve-2026-6875-sandbox-escape-rce/index.md): ServiceNow-hosted customers were protected in April; the real risk is self-hosted and partner-hosted instances that have not taken the July 13, 2026 patches.
- **Check exposure** [Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV](https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/index.md): Only organizations still running retired IOS 12.4 routers are exposed, but a Russian state unit is using this bug; find those boxes, turn off their web server today and replace them.

## Known exploited (CISA KEV)

- [CVE-2008-4128](https://erroneo.us/security/cve/CVE-2008-4128/index.md) Cisco IOS: Cisco IOS Cross-Site Request Forgery Vulnerability (CISA due 2026-07-16)

## Critical advisories

- [CVE-2026-61667](https://erroneo.us/security/cve/CVE-2026-61667/index.md) DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval — PyPI DIRAC >= 6, < 8.0.79 → 8.0.79; PyPI DIRAC >= 8.1.0a1, < 9.0.22 → 9.0.22; PyPI DIRAC >= 9.1.0, < 9.1.10 → 9.1.10
- [CVE-2026-52824](https://erroneo.us/security/cve/CVE-2026-52824/index.md) Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover — Composer (PHP) kimai/kimai <= 2.57.0 → 2.58.0
- [CVE-2026-47677](https://erroneo.us/security/cve/CVE-2026-47677/index.md) FacturaScripts: Account takeover of any 2FA-enabled user — Composer (PHP) facturascripts/facturascripts <= 2026.2 → 2026.3
- [CVE-2026-45579](https://erroneo.us/security/cve/CVE-2026-45579/index.md) DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input — PyPI DIRAC >= 6, < 8.0.79 → 8.0.79; PyPI DIRAC >= 8.1.0a1, < 9.0.22 → 9.0.22; PyPI DIRAC >= 9.1.0, < 9.1.10 → 9.1.10
- [CVE-2026-27690](https://erroneo.us/security/cve/CVE-2026-27690/index.md) SAP Approuter Vulnerable to HTTP Request Smuggling — npm @sap/approuter < 20.10.0 → 20.10.0

---
Source page: https://erroneo.us/security/2026-07-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt