---
title: "Security digest: July 29, 2026"
url: https://erroneo.us/security/2026-07-29/
description: "July 29, 2026 vulnerability digest: 3 briefs (VMware vCenter CVE-2026-59310: Exploited Syslog…); 1 CISA KEV addition (Cisco); 2 critical advisories (Go).…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-29
date_modified: 2026-09-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 29, 2026

3 editorial briefs, 1 known exploited (cisa kev) addition and 2 critical advisories.

## Take stock

- Act now: VMware vCenter CVE-2026-59310: Exploited Syslog RCE . Anyone running vCenter Server 8.0, 9.0 or 9.1, including the vCenter inside VMware Cloud Foundation, vSphere Foundation and Telco Cloud, below the fixed builds.
- Act now: Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password . Anyone running on-premises Cisco Secure Firewall Management Center (hardware or virtual), most urgently where its web interface is reachable from the internet or from broad internal networks.
- Patch this week: Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs . Anyone running Node.js 22.x, 24.x or 26.x, most urgently services that accept HTTP/2 connections directly from untrusted clients or run code under --permission.
- Do you run any of these? Cisco Secure Firewall Management Center (FMC). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-01.
- Go: 2 critical advisories ( github.com/kube-logging/logging-operator , github.com/prebid/prebid-server/v4 , github.com/prebid/prebid-server/v3 , github.com/prebid/prebid-server/v2 , github.com/prebid/prebid-server ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [VMware vCenter CVE-2026-59310: Exploited Syslog RCE](https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/index.md): If you run vCenter and have not installed Broadcom's July 29 fix, patch today and hunt for persistence; this is unauthenticated root code execution with hundreds of victims and ransomware use.
- **Act now** [Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password](https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/index.md): If you run on-premises Cisco FMC and have not installed the July hot fix or a September hardening release, upgrade now and check for the published indicator; the login needs no guessing and CISA ties the bug to ransomware.
- **Patch this week** [Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs](https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/index.md): Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.

## Known exploited (CISA KEV)

- [CVE-2026-20316](https://erroneo.us/security/cve/CVE-2026-20316/index.md) Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (CISA due 2026-08-01)

## Critical advisories

- [CVE-2026-54680](https://erroneo.us/security/cve/CVE-2026-54680/index.md) Logging operator has Fluentd configuration injection that allows remote code execution — Go github.com/kube-logging/logging-operator < 0.0.0-20260608145523-cf437d7f1e05 → 0.0.0-20260608145523-cf437d7f1e05
- [CVE-2026-54735](https://erroneo.us/security/cve/CVE-2026-54735/index.md) prebid-server's request forgery vulnerability allows for possible host environment data extraction — Go github.com/prebid/prebid-server/v4 < 4.4.0 → 4.4.0; Go github.com/prebid/prebid-server/v3 <= 3.30.0 → no fix; Go github.com/prebid/prebid-server/v2 <= 2.32.0 → no fix

---
Source page: https://erroneo.us/security/2026-07-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt