Stop Patching by CVSS Score
Here's a truth that'll make vulnerability managers uncomfortable: your patching queue is probably backwards. You're chasing CVSS 9.8s that require local admin access while the CVSS 7.2 flaw sitting on your internet-facing firewall gets exploited every Tuesday by someone in a time zone you can't find on a map.
Eclypsium just published its inaugural InfraTrust Pulse report for July 2026, and it drives home exactly this point with numbers. The monthly report aggregates security advisories from major infrastructure vendors and ranks them by exploitability, exposure, and real-world risk — not severity scores. The first edition tracked 61 advisories across 14 vendors, including six critical ones and 26 remotely exploitable, unauthenticated vulnerabilities. Six. Twenty-six. Do the math on your current patching backlog and you'll probably find the gap.
The report was authored by Paul Asadoorian, Principal Security Researcher at Eclypsium. It's not a CVE dump. InfraTrust tracks vendor advisories because a single infrastructure advisory can contain dozens — sometimes hundreds — of individual vulnerabilities. The Dell EMC Networking OS10 advisory alone ships with hundreds of upstream Linux kernel fixes, because network operating systems are basically full Linux distributions with enormous attack surfaces. Counting CVEs in that context is like counting raindrops during a hurricane.
This risk-first approach to patching mirrors what CISA is now mandating for federal agencies under BOD 26-04 — see our deep dive on how CISA's risk-centric patching mandate is reshaping federal security. The philosophy is identical: not all vulnerabilities are created equal, and your remediation timeline should reflect real-world exploitability, not just a numerical score.
Source
What InfraTrust Actually Is
Let's be clear about what Eclypsium built here. InfraTrust is two things: a knowledge base for infrastructure cybersecurity, and a monthly pulse report that tells you what to patch first.
The knowledge base part is the long game — a reference library for understanding vulnerabilities in infrastructure, firmware, networking gear, and edge devices. The monthly Pulse report is the tactical piece. It's designed for the person who opens their inbox on Monday morning and has to decide which of the 61 advisories from July actually matters for their environment.
The methodology is straightforward but underappreciated. Eclypsium prioritizes based on three axes: exploitability (can this actually be weaponized?), reachability (does the attacker need to be inside your network or can they hit it from the internet?), and exposure (is this thing sitting at your network edge, facing the public?). A flaw with a lower CVSS score that's internet-reachable and unauthenticated often presents far greater risk than a higher-scoring vulnerability requiring local administrator access.
That's not radical thinking. It's just thinking that most vulnerability management programs have forgotten in their rush to automate triage.
Source
The Six Advisories You Need to Patch Right Now
Eclypsium's report highlights six advisories that demand immediate attention. I'm going to walk through each one, because the "why" matters more than the "what."
SonicWall SMA1000 (SNWLID-2026-0008, CVSS 10.0) — Two actively exploited vulnerabilities affecting an internet-facing remote-access appliance. CVE-2026-15409 and CVE-2026-15410 were being weaponized to install custom malware weeks before SonicWall disclosed them and before CISA added them to the KEV catalog. This is a pre-auth RCE chain, fully exploited in the wild. If you have an SMA1000 at your edge and haven't patched, you're not unlucky — you're negligent.
Fortinet FortiSandbox (FG-IR-26-100 / FG-IR-26-141) — Two critical command injection flaws (CVE-2026-39808 and CVE-2026-25089) that were disclosed back in April and June but only got added to CISA's KEV catalog on July 16, after exploitation was detected. Federal remediation deadline under BOD 26-04 was July 19. These weren't in Eclypsium's 30-day window, but they included them anyway because organizations likely haven't patched and don't know they're being targeted.
Dell Networking OS10 / SmartFabric Manager (DSA-2026-240 / DSA-2026-317) — Critical remotely exploitable, unauthenticated vulnerabilities in switching and data-center fabric management. The OS10 advisory alone includes hundreds of upstream fixes. These are the boxes that manage your data center's switching fabric, and they're sitting inside your network perimeter like a loaded gun with the safety off.
F5 BIG-IP (K000161837, CVSS 9.2) — Unauthenticated memory-safety flaws on internet-facing application delivery controllers and load balancers. These devices frequently sit at the edge of enterprise networks, making them prime targets. Unauthenticated remote code execution on an ADC is basically a gift to any scanner operating at scale.
Juniper Junos OS (JSA110083 / JSA110086) — Remotely exploitable flaws that crash MX and SRX routers, potentially causing denial-of-service conditions. One hits the core routing plane, the other exploits the SIP ALG. Both are unauthenticated. Your service provider's Juniper gear might be more vulnerable than you think.
NVIDIA BlueField / ConnectX (Bulletin 5699, CVSS 9.0) — Code execution vulnerabilities in BlueField DPUs and ConnectX SmartNICs used in AI and data-center infrastructure. This is the new attack surface — the networking silicon in the data path, not the CPU running your OS.
Source
State Actors Are Hunting Your Edge Devices
The timing of InfraTrust isn't coincidental. Russian and Chinese state-sponsored threat actors have been systematically targeting vulnerable network edge devices for years, and the pattern is well documented.
Volt Typhoon and Salt Typhoon — both attributed to Chinese state-sponsored hacking groups — have repeatedly exploited flaws in routers, VPNs, firewalls, and other internet-facing infrastructure to breach critical infrastructure and telecommunications providers. The playbook is consistent: find the unpatched device at your edge, pivot inward, move laterally toward high-value targets.
This isn't theoretical. The SonicWall SMA1000 flaws were actively exploited before disclosure. The Fortinet CVEs sat in the wild for months before CISA noticed. State actors don't wait for vendor patches. They wait for vendors to disclose the vulnerability, then they scan for unpatched instances and move in.
The InfraTrust report flags advisories containing actively exploited vulnerabilities or flaws tracked in CISA's Known Exploited Vulnerabilities catalog specifically because that's the signal that matters most. If CISA says it's being exploited, stop reading about it and start patching.
Source
The Firmware Lag Problem
Here's something the report calls out that doesn't get enough attention: firmware and hardware vulnerability updates commonly lag behind upstream security fixes.
The reason is structural. When a component vendor — say, Qualcomm — patches a vulnerability in a GPU driver, the OEM that integrated that component into their device has to rebuild, test, and distribute the firmware update. That process takes time. Months, sometimes.
Eclypsium points to HP's Poly Video advisory as a concrete example. It shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA's KEV catalog. Four months of exposure for a known, exploited flaw — because the fix had to flow through an OEM's validation pipeline.
This is why infrastructure security requires a different mindset than endpoint security. On endpoints, you push an agent update and you're done. On infrastructure gear — routers, switches, BMCs, SmartNICs, video codecs — the update chain involves hardware vendors, firmware rebuilds, and often physical access for deployment. The exposure window is inherently longer.
The report also flags several OEM-dependent fixes where the Qualcomm Snapdragon and networking chipsets advisory explicitly notes that OEM-dependent fixes extend the exposure window. If you're running hardware with these chipsets, your patching timeline is dictated by the OEM's release schedule, not by when the vulnerability was disclosed.
Firmware-level attacks are especially dangerous because they execute before your OS even loads. As we covered in our analysis of six critical U-Boot bootloader vulnerabilities that enable pre-boot firmware attacks, once an attacker controls the earliest boot stage, reinstalling the OS won't fix the compromise. The same principle applies to BMCs, SmartNICs, and other infrastructure components that run their own firmware independently of the host OS.
Source
The Full July 2026 Advisory Landscape
Beyond the six priority advisories, Eclypsium tracked 61 total infrastructure advisories across 14 vendors. Here's the complete picture, organized by severity:
Critical (CVSS 9.0+): SonicWall SMA1000 (actively exploited, CVSS 10.0), Dell EMC Networking OS10 (CVSS 9.8, CISA-listed exploited Linux flaw), Dell SmartFabric Manager (CVSS 9.8), F5 BIG-IP (CVSS 9.2, unauthenticated memory-safety flaws), Lenovo ThinkSystem servers (CVSS 9.0, code execution on DPUs/SmartNICs), and NVIDIA BlueField/ConnectX (CVSS 9.0, code execution on networking silicon).
High (CVSS 7.5-8.8): Juniper Junos OS flaws across multiple platforms — MX/SRX routers (DoS via unauthenticated remote attacks, CVSS 8.7), PTX core routers (CVSS 8.2), SRX packet processing (CVSS 8.2). Fortinet FortiSandbox with unauthenticated VNC access on all network interfaces (CVSS 8.6). Citrix NetScaler ADC client flaws (CVSS 8.5). Dell PowerProtect Data Manager command injection (CVSS 8.5). HP Poly Voice with malicious SIP server attacks (CVSS 8.2). Dell iDRAC9 and iDRAC10 BMC flaws (CVSS 7.5-7.8). HP PC BIOS firmware-update flaws leading to code execution (CVSS 7.8). Cisco Catalyst Center arbitrary file read (CVSS 7.5) and ClamAV flaw that can disable malware scanning (CVSS 7.5). Palo Alto PAN-OS User-ID TSA unauthenticated DoS and possible code execution (CVSS 7.2).
Medium and Low: The remaining advisories include Fortinet FortiOS/FortiProxy issues (authenticated buffer overflow, pre-auth XSS, response splitting), HPE Aruba Instant On switches with unauthenticated cryptographic secret disclosure, Netgear routers with command injection and stack-overflow flaws, additional Juniper Junos OS issues (sFlow memory leaks, IKE negotiation crashes, URL-parsing flaws bypassing web filters), and multiple Palo Alto PAN-OS vulnerabilities ranging from certificate-validation flaws enabling VPN interception to IPv6 policy bypasses.
The breadth is striking. Sixty-one advisories from a single month across 14 vendors. And that's just the ones Eclypsium deemed worth tracking — it doesn't include every vendor disclosure, only those meeting their infrastructure-relevance criteria.
The volume of vulnerabilities being discovered and weaponized is accelerating. Microsoft's June 2026 Patch Tuesday alone addressed a record 206 CVEs, including 20 zero-days — see our coverage of how AI is accelerating vulnerability discovery and what it means for patch management. InfraTrust's approach of tracking vendor advisories rather than individual CVEs is one way to cut through that noise and focus on what actually matters for your infrastructure.