Deadline Watch: Incomplete Patches, Persistent Post-Exploit Mechanisms, and RCE in Collaboration Tools

Three entries this week share a particularly troubling characteristic: they involve either bypasses of previous fixes or vulnerability classes historically associated with ransomware and nation-state pre-positioning.

CVE-2026-18577 (N-able N-central) was added to KEV today, August 3, with an aggressive three-day patch window expiring August 6. This is explicitly an incomplete patch for CVE-2026-18556 — meaning threat actors have already reverse-engineered the original fix and found an alternate authentication bypass path. RMM platforms like N-central are perennial targets because compromising the management layer compromises every endpoint it manages. Organizations must apply the new patch, not assume the previous remediation was sufficient. Conduct a full review of any accounts created or modified in N-central since CVE-2026-18556 was first patched; account takeover in RMM tools frequently precedes mass ransomware deployment.

CVE-2025-68686 (Fortinet FortiOS) carries a patch deadline of August 10 — the furthest out in this batch — but don't let that lull teams into complacency. This vulnerability allows a remote unauthenticated attacker to bypass Fortinet's own remediation for the symbolic link persistence mechanism previously documented in post-exploitation cases. That means attackers who already established persistence via an earlier FortiOS compromise may retain a covert foothold even after organizations believed they had cleaned the environment. The forensic implication is significant: any FortiOS device previously assessed as clean following earlier Fortinet campaigns should be re-evaluated. CISA's Forensics Triage Requirements under BOD 26-04 are directly applicable here.

CVE-2026-50522 (Microsoft SharePoint) closed its patch window on July 25 and describes a deserialization of untrusted data vulnerability enabling unauthenticated remote code execution over the network. SharePoint deserialization vulnerabilities have a well-documented history of exploitation by both criminal ransomware groups and APT actors for initial access into enterprise environments. Any internet-facing SharePoint deployment that has not yet applied Microsoft's patch should be treated as a priority incident. Credential harvesting and lateral movement to Azure-connected resources are the most likely follow-on actions; review SharePoint audit logs and OAuth token issuance for anomalies dating back to late July.

Emerging and Long-Tail Targets: AI Tooling and Embedded Router Firmware

Two entries represent different ends of the exposure spectrum but share the characteristic of being overlooked in standard vulnerability management programs.

CVE-2026-0770 (Langflow) allows remote code execution via inclusion of functionality from an untrusted control sphere — a class of vulnerability particularly dangerous in AI workflow orchestration tools, where arbitrary code execution in the pipeline context can compromise model inputs, training data, and downstream API integrations. The July 24 deadline has passed. DevOps and MLOps teams adopting Langflow for agentic or RAG workflows should patch immediately, restrict the Langflow interface to internal networks only, and audit pipeline configurations for injected or modified components.

CVE-2021-27137 (DD-WRT) is a five-year-old stack-based buffer overflow in the UPnP stack, now confirmed exploited in the wild and added to KEV on July 21 with a July 24 deadline. DD-WRT appears in home routers, small office environments, and some OT-adjacent network segments. Its presence in KEV in 2026 signals active threat actor interest — likely targeting remote workers or branch office infrastructure as an initial access vector. UPnP should be disabled on any DD-WRT device that cannot immediately receive firmware updates, and organizations should audit their asset inventories for consumer-grade router firmware in environments handling sensitive data.

Recommended Immediate Actions

• Overdue deadlines (CVE-2026-20316, CVE-2026-16812, CVE-2026-16232, CVE-2026-50522, CVE-2021-27137, CVE-2026-0770): Escalate to incident response posture; patch or isolate now, initiate forensic triage per BOD 26-04.
• August 6 deadline (CVE-2026-18577): Emergency patching sprint this week; assume prior N-central remediation is insufficient.
• August 10 deadline (CVE-2025-68686): Re-assess all previously remediated FortiOS devices for residual persistence before patching.
• Rotate credentials on all affected platforms regardless of confirmed exploitation status.
• Document compliance actions and retain forensic artifacts as required under BOD 26-04.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Cisco Security Advisory — FMC · Fortinet PSIRT Advisories · Microsoft Security Update Guide — SharePoint · Check Point Security Advisories · Arista Security Advisories · N-able Security Advisories · CISA Langflow Alert