Top 5 Cybersecurity News Stories July 31, 2026
The five stories in this week’s Cybersecurity News Stories July 31, 2026 each describe a different failure at the same architectural level: not the application layer, not the endpoint estate, not even the network perimeter as conventionally modelled — but the foundational infrastructure that the perimeter, the applications, and the endpoints depend on in order to function. The attackers did not breach a water utility’s enterprise IT network to reach the Minnesota facilities they disrupted on July 26 and 27; they reached the OT controllers governing physical safety processes in more than thirty community water systems by exploiting a five-year-old, publicly documented, effectively unpatchable Rockwell Automation PLC vulnerability. JetBrains disclosed a critical CVSS 9.8 unauthenticated remote code execution flaw in TeamCity On-Premises — the CI/CD build automation platform through which software reaches production environments — requiring no credentials, no user interaction, and no existing access beyond HTTP reach of the server. A public proof-of-concept exploit published on July 24 demonstrated that a standard, low-privileged Active Directory domain user can exploit a certificate enrollment fallback in Active Directory Certificate Services to impersonate a domain controller, extract the credentials that underpin the entire AD trust model, and achieve full domain compromise without running a single piece of malware or requiring administrative rights. NGINX, the reverse proxy and web server fronting a substantial fraction of the world’s internet-facing applications, carries a fifteen-year-old heap buffer overflow that, combined with a companion information leak, produces a pre-authentication exploit chain that bypasses ASLR and executes code on the server. And Cisco’s Secure Firewall Management Center — the administrative platform used to configure and push security policy across Cisco firewall infrastructure — was added to CISA’s Known Exploited Vulnerabilities catalog on July 29 because attackers are authenticating to it using a hardcoded built-in credential that no administrator configuration can remove. None of these are application vulnerabilities. All of them are the layer beneath the application — the safety controller, the build pipeline, the trust infrastructure, the delivery layer, the policy management system.
1) Coordinated Cyberattack Shuts Down Water Treatment OT Systems Across Minnesota — 30+ Utilities Hit, CVE-2021-22681 Exploited at Scale
On July 26 and 27, 2026, a coordinated cyberattack struck more than thirty Minnesota community water and wastewater utilities, forcing multiple facilities to switch from automated to manual operation and taking at least one treatment plant entirely offline. Water quality in affected municipalities was not compromised and no community issued usage restrictions, but the operational impact — facility staff managing safety-critical treatment processes manually rather than through automated control systems — was the direct consequence of compromised OT controllers. Attribution is still under investigation; no U.S. government agency has formally attributed the Minnesota attacks at time of writing. Tenable’s threat intelligence team assessed the activity as consistent with CyberAv3ngers, the Iran-linked threat actor named in CISA’s prior advisories for targeting US water infrastructure — including advisory AA26-097A, issued four days before the Minnesota attacks began.
The technical mechanism identified across affected facilities is CVE-2021-22681, a critical vulnerability in Rockwell Automation’s Studio 5000 Logix Designer that allows an attacker with network access to forge authentication credentials to the PLC, bypass the signature verification protecting project integrity, and modify the programmed logic governing process operation. The vulnerability has been publicly documented since 2021. It has not been patched in the vast majority of affected facilities — because the patching constraint in OT environments is not technical; it is operational. Taking an industrial controller offline for a software update at a live water treatment facility requires scheduling planned outages around treatment cycle windows, obtaining engineering sign-off, and coordinating with regulatory authorities in some jurisdictions. CISA issued advisory AA26-097A on July 22 — four days before the Minnesota attacks began — specifically to warn of Iranian actor targeting of OT systems using Rockwell Automation, Schneider Electric, and Siemens platforms. The advisory named the relevant access vectors and specified mitigations. The attacks began four days after the warning. The gap between knowing the threat and having the operational capacity to mitigate it across more than thirty utilities operating under different management structures, budget constraints, and maintenance schedules is precisely the structural exposure this pattern reveals.
For any DACH-region operator of water infrastructure, utilities, or industrial facilities running Rockwell Automation, Siemens, or Schneider Electric PLCs with internet-accessible engineering workstations, the Minnesota incident is not a US-specific scenario. The advisory that warned of it explicitly names the OT platforms dominant in European critical infrastructure, and the exploitation window for CVE-2021-22681 has not closed.
On July 26–27, 2026, attackers exploiting CVE-2021-22681 forced 30+ Minnesota water utilities to switch to manual operation — the OT controllers governing safety-critical treatment processes were the target, not the enterprise IT network.
Read more on: The Hacker News · SecurityWeek · BleepingComputer
2) JetBrains TeamCity CVE-2026-63077 — CVSS 9.8 Unauthenticated RCE in the Platform That Builds Your Software, Manages Your Deployment Pipelines, and Holds Every Credential They Use
On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all versions of TeamCity On-Premises. The vulnerability resides in TeamCity’s agent polling protocol — the communication channel through which build agents receive work assignments from the central TeamCity server. By crafting requests that abuse this protocol, an unauthenticated attacker with HTTP or HTTPS access to the TeamCity server can bypass authentication and execute arbitrary operating system commands with the privileges of the TeamCity server process. Fixed versions are 2025.11.7 and 2026.1.3; a security patch plugin covers versions from 2017.1 onwards. JetBrains stated it was not aware of active exploitation at the time of disclosure.
The strategic significance of CVE-2026-63077 lies not in the technical exploitation path but in what TeamCity On-Premises holds. A CI/CD platform is the build infrastructure — the system that compiles source code, runs tests, manages release pipelines, and pushes software to production. In most deployments, TeamCity holds stored credentials for every system the build pipeline interacts with: source code repositories, container registries, cloud platforms, production servers, code-signing keys, and secrets management services. An unauthenticated attacker with code execution on the TeamCity server does not gain access to one application — they gain access to the credentials and deployment material for every system in the pipeline.
The historical precedent for this class of vulnerability is directly relevant: CVE-2024-27198, a critical authentication bypass in the same platform published in March 2024, was exploited within days of disclosure by ransomware operators, nation-state groups, and initial access brokers. The 2026 version of the same vulnerability class, in the same platform, carries the same CVSS score. Organisations running TeamCity On-Premises — particularly those managing deployments to cloud infrastructure, production databases, or containerised environments — should treat the window following Rapid7’s published exploitation research as the effective patching deadline, regardless of JetBrains’ stated awareness of exploitation status.
CVE-2026-63077 (CVSS 9.8): unauthenticated RCE on TeamCity On-Premises gives an attacker access to every credential stored in the build and deployment pipeline — the same vulnerability class that was weaponised within days of disclosure in 2024.
Read more on: The Hacker News · Rapid7 · JetBrains Security Blog
3) Certighost CVE-2026-54121 — A Standard Domain User Becomes a Domain Controller, Active Directory Certificate Services Issues the Certificate, and the Entire Active Directory Environment Follows
CVE-2026-54121, named Certighost, is an improper-authorization vulnerability in Active Directory Certificate Services — the Windows Server role that operates the Public Key Infrastructure for most enterprise Active Directory environments, issuing the certificates used for authentication, code signing, encryption, and secure communication across the estate. Researchers H0j3n and Aniq Fakhrul reported the flaw to Microsoft on May 14, 2026; Microsoft patched it in the July 14, 2026 Patch Tuesday release. On July 24, the researchers published full technical details and a working proof-of-concept exploit tool.
Certighost exploits a fallback behaviour in AD CS’s certificate enrollment process — specifically, the “chase” mechanism triggered during directory-object resolution when the Certification Authority cannot resolve a subject’s identity through the primary path. By supplying specific request attributes including a subject alternative name that references an attacker-controlled host, a standard, low-privileged domain user can cause the CA to request identity data from the attacker-controlled host and use that data to issue a certificate authenticating the attacker as a Domain Controller. A certificate authenticating as a Domain Controller enables PKINIT Kerberos authentication, which in turn enables a DCSync operation — the technique that extracts the krbtgt account credential, the master key that signs all Kerberos tickets in the domain. With the krbtgt hash, an attacker can forge Golden Tickets providing permanent, silent access to every resource in the environment.
The attack requires no administrator interaction, no victim clicking anything, and no malware. It requires a domain user account and network access to the CA’s enrollment interface. Microsoft’s July patch adds a hostname-validation gate to the chase logic that closes the path. The public PoC released July 24 makes the patching urgency operationally concrete: for any organisation that has not yet deployed the July 14 Patch Tuesday update — which for many DACH enterprises managing on-premises AD environments across multiple domains represents a multi-week deployment cycle — there is now a public, working, step-by-step exploitation path from standard domain user to complete domain compromise. The AD CS component specifically should be treated as a trigger for emergency out-of-band patch deployment independent of the broader Patch Tuesday rollout schedule.
Certighost (CVE-2026-54121): a standard domain user exploits the AD CS enrollment fallback to obtain a certificate impersonating a Domain Controller, enabling DCSync and full domain compromise — no malware, no admin rights required.
Read more on: BleepingComputer · Help Net Security
4) NGINX CVE-2026-42533 — A Fifteen-Year-Old Heap Overflow Produces a Pre-Authentication RCE Chain on the Reverse Proxy Sitting in Front of Your Applications
CVE-2026-42533 is a heap buffer overflow in NGINX’s handling of the map directive when regular expression matching references PCRE capture variables through NGINX’s two-pass script evaluation engine. The vulnerability exists in NGINX versions from 0.9.6, released in 2011, through 1.30.3 stable and 1.31.2 mainline. Fixed releases are 1.30.4 and 1.31.3. A public proof-of-concept exploit was published on July 28, 2026.
The exploit combines two primitives: an attacker-controlled heap buffer overflow triggered by crafted HTTP request content — URI, header, or body — and a companion heap pointer information leak accessible through the same request path that defeats ASLR. Chained, the two primitives produce a pre-authentication remote code execution path that the researcher demonstrated with a reported success rate of ten out of ten against Ubuntu 24.04 with glibc 2.39 and ASLR enabled. The configuration condition required for exploitation — the map directive with PCRE regex capture variable references — is a common pattern in production NGINX deployments used as load balancers, API gateways, and TLS-terminating reverse proxies. F5’s NGINX Ingress Controller — the commercially supported product used in many enterprise Kubernetes environments — is additionally affected and carries its own fixed releases: version 5.5.3 on the standard track and 2026-lts-r4 on the LTS track. The upstream community Kubernetes ingress-nginx project is separately affected; Orca Security notes that this project compiles NGINX directly into its binary as a non-swappable dependency, and that no patch is expected from the upstream project itself — leaving clusters running it dependent on manual intervention at the cluster level.
No confirmed active exploitation has been reported at the time of publication, but the combination of a pre-authentication exploit chain with ASLR bypass, a working public PoC, and NGINX’s deployment scale as one of the world’s most widely deployed web infrastructure components creates the conditions in which exploitation should be assumed to follow disclosure within a short window. The exposure profile of CVE-2026-42533 is significant precisely because NGINX is often treated as stable, low-maintenance infrastructure — the proxy in front of the application that requires active management, while NGINX itself receives updates only when a CVE surfaces. That operational posture leaves a fifteen-year window of vulnerability present in production.
CVE-2026-42533: a heap buffer overflow present in NGINX since 2011, chained with a heap pointer leak for ASLR bypass, produces pre-authentication remote code execution on NGINX reverse proxy and ingress deployments.
Read more on: The Hacker News · Orca Security · The CyberSec Guru
5) Cisco Secure Firewall Management Center CVE-2026-20316 — CISA Adds Hardcoded Credential to KEV on July 29, and the CVSS Score Said Medium Risk
CVE-2026-20316 is a use-of-hard-coded-password vulnerability in Cisco Secure Firewall Management Center — the administration platform used to manage, monitor, and configure Cisco Secure Firewall appliances and Firepower devices across an organisation’s network security infrastructure. CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on July 29, 2026, with a remediation deadline binding on US federal agencies under Binding Operational Directive 26-04. The vulnerability allows an unauthenticated remote attacker to authenticate to FMC using a built-in, low-privileged account whose credentials are hardcoded in the software. There is no administrator configuration that removes or disables the account.
The hardcoded credential provides access to sensitive information stored on the FMC system, including firewall policy details, network topology information, and device configuration data. Cisco assigns CVE-2026-20316 a CVSS base score of 5.3 — a Medium severity rating that, under standard vulnerability management prioritisation practices, would typically queue it below higher-scored items and place it outside most organisations’ emergency patching criteria. Cisco’s own advisory rates the actual risk as High, noting explicitly that the access obtained via the hardcoded credential can be chained with other FMC vulnerabilities to achieve full system compromise. CISA’s KEV addition confirms that this is not a theoretical chaining risk — exploitation is confirmed in the wild.
The divergence between CVSS 5.3 and active in-the-wild exploitation in a CISA-listed vulnerability has a direct operational implication: any security programme that uses CVSS score as the primary or sole triage mechanism for patch prioritisation will systematically under-prioritise exploited vulnerabilities whose severity is genuinely captured by context and chaining potential rather than the base scoring model alone. Cisco FMC is the platform that pushes security policy to the firewalls enforcing network segmentation and threat prevention across the entire security perimeter. No workaround exists — only hotfixes for FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. The CISA KEV addition on July 29 is the relevant signal.
CVE-2026-20316 — CVSS 5.3, actively exploited, CISA KEV as of July 29, 2026: the hardcoded credential in Cisco FMC cannot be removed by administrator configuration. The CVSS score does not reflect the actual risk.
Read more on: BleepingComputer · The Hacker News · CISA
If this week’s Cybersecurity News Stories July 31, 2026 tells us anything, it’s this:
The five stories in this week’s Cybersecurity News Stories July 31, 2026 each describe a compromised or exploited component that occupies a foundational position in the technology stack rather than a peripheral or application position. The Rockwell Automation PLC vulnerability in the Minnesota water attack has been documented since 2021, has been the subject of CISA advisories, and was specifically named in an updated advisory issued four days before the attacks occurred. It was not patched across thirty-plus utilities in the four-day window between the warning and the attack — not because the operators lacked awareness or intent, but because the patch cycle for safety-critical OT equipment is structurally incompatible with the timeline an adversary operates on. TeamCity On-Premises holds the credentials and deployment material for the entire software supply chain, and a CVSS 9.8 unauthenticated exploit for the same platform was aggressively weaponised in 2024. The platform’s 2026 variant of the same vulnerability class carries the same score. Certighost demonstrates that Active Directory Certificate Services — the infrastructure component that certifies who is who in the domain — can be used by a standard domain user to certify themselves as a domain controller, collapsing the entire authentication model from inside. NGINX has served pre-authentication requests since 2011 with a heap overflow in its regex map handling that a researcher combined with an ASLR bypass to produce reliable code execution. And Cisco FMC received a CVSS 5.3 for a hardcoded credential that CISA has now confirmed is being actively exploited.
The structural pattern this week is not a failure of the perimeter. Each of the five components under attack is positioned to support, govern, or enforce the perimeter from behind: the safety logic that ensures industrial equipment operates within safe parameters, the pipeline that produces the software running on the perimeter, the certificate authority that validates perimeter identities, the proxy that receives perimeter traffic before any application processes it, and the management console that configures what the perimeter blocks. The security programme that is well-instrumented at the application and endpoint layer, and that remediates CVEs ordered by CVSS score, may be operating correctly within the model it has defined — while the actual attack surface has moved one layer deeper into the infrastructure the model depends on. The Minnesota attack and the Cisco FMC exploitation are both examples of adversaries acting in the gap between when a risk is known and when the organisation’s operational constraints permit remediation. The TeamCity, Certighost, and NGINX disclosures are examples of the same gap opening at the moment of public PoC release. In all five cases, the window exists. The question is whether the response velocity matches the adversary’s.
For more information, please contact us now!
