--- title: Cyber Threat Intelligence Report | 7/13/2026 | PacketWatch description: This week, we briefed our clients on details of the Progress ShareFile shutdown on Friday, July 10th, and other vulnerabilities from the past two weeks. --- [Cyber Threat Intelligence | PacketWatch ](https://packetwatch.com/resources/threat-intel) # [Cyber Threat Intelligence Report | 7/13/2026 | PacketWatch ](https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-07-13-2026) Written by [PacketWatch Team Sixty43](https://packetwatch.com/resources/threat-intel/author/the-packetwatch-intelligence-team) | July 14, 2026   This week, we briefed our clients on details of the Progress ShareFile shutdown on Friday, July 10th, and other vulnerabilities from the past two weeks.  KEY TAKEAWAYS  - Progress shuts down ShareFile servers due to “credible external security threat”. Possible 0-day.  - Critical and high-severity vulnerabilities in PAN-OS, BeyondTrust, Adobe ColdFusion, Ubiquiti, Citrix NetScaler, Zimbra, Progress Kemp LoadMaster, plus updates to CISA KEV, patch now!   ## Progress ShareFile Shutdown On Friday, July 10, Progress sent its customers an urgent message, urging them to *immediately *shut down the Windows servers hosting their Progress ShareFile Storage Zone Controllers. This message was due to a supposed "credible external security threat" targeting these systems. Additionally, as a precaution, Progress disabled access to ShareFile accounts using the Storage Zone Controllers. A copy of the message was published to [The Hacker News](https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html), which states that updates would be shared within 24 hours. However, at the time of this writing, no further updates have been published. The current message on the ShareFile status [page](https://status.sharefile.com/) only shows the following:     This event comes shortly after Progress [disclosed](https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-04-06-2026#multiple-vulnerabilities-in-progress-sharefile) an authentication bypass (CVE-2026-2699) and remote code execution flaw (CVE-2026-2701) in ShareFile in early April. However, it is unlikely these events are related, as Progress would simply recommend applying the patches for these vulnerabilities if they were being exploited. While not confirmed, this series of events signals a zero-day vulnerability in ShareFile. Progress products have repeatedly been targets for cybercriminals and data extortion groups in the past. In 2023, while still owned by Citrix, CISA flagged [CVE-2023-24489](https://nvd.nist.gov/vuln/detail/CVE-2023-24489) (an improper access control vulnerability) as actively exploited. In June 2023, Cl0p was able to steal data from thousands of organizations by [exploiting](https://packetwatch.com/resources/threat-intel/moveit-transfer-zero-day-exploit-may-2023) a zero-day in Progress MOVEit Transfer. Any internet-exposed device carries risk, but file-share devices or any sort of data store that is directly accessible via the internet are always going to be prime targets for cybercriminals. Organizations should immediately adhere to any such notices from the vendor regarding security threats or incidents to reduce and prevent impact. In this specific incident, administrators are strongly advised to keep affected controllers offline until Progress gives details on the threat and says the systems are safe to restart. Administrators should also verify that systems are updated to the current version to protect them from previously disclosed vulnerabilities. Additionally, out of an abundance of caution, it is recommended to preserve server logs and check for any unfamiliar .aspx files in the web folders and storage paths. PacketWatch will update this article once more information is disclosed by Progress.   Update - 7/14/26 On July 14 at 11:06 EDT, Progress updated the ShareFile status [page](https://status.sharefile.com/) to announce that customer access for Storage Zones Controller is being restored and that recovery instructions were provided directly to customers. The recovery instructions state that they identified a “high severity path traversal vulnerability in Progress ShareFile Storage Zones Controller affecting versions 5.x and 6.x.” Details of the newly discovered 0-day vulnerability state that “an authenticated administrative user can read arbitrary files accessible to the application’s service account, write threat actor-controlled content to arbitrary directories or enumerate the server filesystem layout.” Per the recovery instructions document, Progress states they have “no indication of unauthorized access to any ShareFile customer account or data, and have not identified any active threat.” There is currently no CVE assigned to this vulnerability, but it will be published in two weeks, according to the instructions. In order to patch this vulnerability, users running on v5 (all versions) should patch to v5.12.5. Users running v6 (all versions) should patch to v6.0.2.    Resources - [https://status.sharefile.com/](https://status.sharefile.com/) - [https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html](https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html) - [https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/](https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/) - [https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-04-06-2026#multiple-vulnerabilities-in-progress-sharefile](https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-04-06-2026%23multiple-vulnerabilities-in-progress-sharefile) - [https://packetwatch.com/resources/threat-intel/moveit-transfer-zero-day-exploit-may-2023](https://packetwatch.com/resources/threat-intel/moveit-transfer-zero-day-exploit-may-2023)     Vulnerability Roundup   ### **Two Critical Vulnerabilities in BeyondTrust** BeyondTrust recently published a security advisory highlighting 4 vulnerabilities (2 critical, 2 high) discovered through their AI vulnerability research program. [CVE-2026-40138](https://nvd.nist.gov/vuln/detail/CVE-2026-40138) is a critical authentication bypass in BeyondTrust Remote Support and Privileged Remote Access. [CVE-2026-40139](https://nvd.nist.gov/vuln/detail/CVE-2026-40139) is another authentication bypass that exists in BeyondTrust Remote Support. Both vulnerability descriptions state that "exploitation requires a specific authentication configuration to be enabled", however, this configuration is not specified in the report. These vulnerabilities affect Remote Support RS 25.3.2 or lower, and Privileged Remote Access PRA 25.3.2 or lower. Administrators are urged to upgrade as soon as possible.** ** - [https://www.beyondtrust.com/trust-center/security-advisories/bt26-03](https://www.beyondtrust.com/trust-center/security-advisories/bt26-03) - [https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/](https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/)    ### **New PAN-OS Buffer Overflow Vulnerability** On July 8, Palo Alto Networks [released](https://security.paloaltonetworks.com/CVE-2026-0288) a security bulletin for a high-severity vulnerability affecting the User-ID Terminal Server Agent (TSA) component of their PAN-OS software. Tracked as [CVE-2026-0288](https://nvd.nist.gov/vuln/detail/CVE-2026-0288), the flaw allows an unauthenticated attacker with network access to cause a denial-of-service (DoS) condition and potentially execute arbitrary code by sending specially crafted network traffic. The following table shows affected versions and their associated fix:     Per the advisory, this vulnerability only affects PAN-OS devices with at least one Terminal Server Agent entry configured. To check if the device is configured with an agent, go to: Device -> User Identification -> Terminal Server Agents. Additional mitigation includes restricting User-ID Terminal Server Agent connectivity to only trusted internal IP addresses. - [https://security.paloaltonetworks.com/CVE-2026-0288](https://security.paloaltonetworks.com/CVE-2026-0288)   ### **Multiple Maximum-Severity Flaws in Adobe ColdFusion and Campaign Classic** Adobe released security updates to address 7 maximum-severity [vulnerabilities](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) (plus 2 critical vulnerabilities) in Adobe ColdFusion and one maximum-severity [vulnerability](https://helpx.adobe.com/security/products/campaign/apsb26-69.html) in Adobe Campaign Classic. Regarding Adobe ColdFusion, [CVE-2026-48276](https://nvd.nist.gov/vuln/detail/CVE-2026-48276) and [CVE-2026-48283](https://nvd.nist.gov/vuln/detail/CVE-2026-48283) are unrestricted file upload vulnerabilities that can lead to arbitrary code execution. [CVE-2026-48277](https://nvd.nist.gov/vuln/detail/CVE-2026-48277), [CVE-2026-48281](https://nvd.nist.gov/vuln/detail/CVE-2026-48281), and [CVE-2026-48316](https://nvd.nist.gov/vuln/detail/CVE-2026-48316) are improper input validation flaws that can lead to arbitrary code execution. [CVE-2026-48282](https://nvd.nist.gov/vuln/detail/CVE-2026-48282) is a path traversal vulnerability that can lead to arbitrary code execution. The other 2 critical vulnerabilities, [CVE-2026-48313](https://nvd.nist.gov/vuln/detail/CVE-2026-48313) and [CVE-2026-48315](https://nvd.nist.gov/vuln/detail/CVE-2026-48315) are path traversal and input validation vulnerabilities that can lead to file system read and privilege escalation. These issues have been fixed in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. One maximum-severity vulnerability was addressed for Adobe Campaign Classic, [CVE-2026-48286](https://nvd.nist.gov/vuln/detail/CVE-2026-48286). Successful exploitation can allow an attacker to run arbitrary code on affected systems. This issue was patched with versions ACC v7: 7.4.3 build 9397. Administrators are urged to apply the updates as soon as possible due to the criticality of these vulnerabilities. - [https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) - [https://helpx.adobe.com/security/products/campaign/apsb26-69.html](https://helpx.adobe.com/security/products/campaign/apsb26-69.html) - [https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)   ### **Multiple Critical Vulnerabilities in Ubiquiti Products** On July 2, Ubiquity [published](https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) a security bulletin addressing 7 critical vulnerabilities across a variety of their products, including one rated as maximum severity. These flaws impact UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS, and successful exploitation ranges from privilege escalation to arbitrary command execution. The vulnerabilities are tracked as the following: [CVE-2026-50746](https://nvd.nist.gov/vuln/detail/CVE-2026-50746), [CVE-2026-50747](https://nvd.nist.gov/vuln/detail/CVE-2026-50747), [CVE-2026-50748](https://nvd.nist.gov/vuln/detail/CVE-2026-50748), [CVE-2026-54400](https://nvd.nist.gov/vuln/detail/CVE-2026-54400), [CVE-2026-55115](https://nvd.nist.gov/vuln/detail/CVE-2026-55115), [CVE-2026-54402](https://nvd.nist.gov/vuln/detail/CVE-2026-54402), and [CVE-2026-55116](https://nvd.nist.gov/vuln/detail/CVE-2026-55116). Administrators are urged to review the [advisory](https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) for details on the vulnerable product versions and their corresponding fix. - [https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc](https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) - [https://thehackernews.com/2026/07/ubiquiti-patches-critical-unifi-flaws.html](https://thehackernews.com/2026/07/ubiquiti-patches-critical-unifi-flaws.html)   ### **Multiple Vulnerabilities in Citrix NetScaler Products** Citrix recently [released](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604) a security update for Netscaler ADC and NetScaler Gateway that addresses 5 high and 1 medium vulnerabilities. Successful exploitation of these flaws can lead to arbitrary file reads or denial-of-service (DoS). The vulnerabilities are tracked as [CVE-2026-8451](https://nvd.nist.gov/vuln/detail/CVE-2026-8451), [CVE-2026-8452](https://nvd.nist.gov/vuln/detail/CVE-2026-8452), [CVE-2026-8655](https://nvd.nist.gov/vuln/detail/CVE-2026-8655), [CVE-2026-10816](https://nvd.nist.gov/vuln/detail/CVE-2026-10816), [CVE-2026-10817](https://nvd.nist.gov/vuln/detail/CVE-2026-10817), and [CVE-2026-13474](https://nvd.nist.gov/vuln/detail/CVE-2026-13474). These affect the following products and versions: An additional step must be performed to remediate CVE-2026-13474. Administrators must configure the Http2SmallWndTimeout parameter, which controls the timeout (in seconds) for HTTP/2 small-window stalled streams. Per the advisory, the configuration command is as follows: set ns httpProfile -http2SmallWndTimeout . - [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604) - [https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html](https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html)    ### **Critical XSS Vulnerability in Zimbra Classic Web Client** Zimbra [released](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.19) a fix for a critical cross-site scripting (XSS) vulnerability in their Classic Web Client. Per their release [update](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-19/), "a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings." There is currently no CVE assigned to this vulnerability. Administrators are urged to upgrade to ZCS v10.1.19 as soon as possible. - [https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-19/](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-19/) - [https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.19](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.19) - [https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html](https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html)    ### **Progress Kemp LoadMaster RCE Under Active Exploitation** In their June Security Update, Progress [released](https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691) fixes for one critical and one high-severity vulnerability in their Kemp LoadMaster (load balancer) product. The critical vulnerability, tracked as [CVE-2026-8037](https://nvd.nist.gov/vuln/detail/CVE-2026-8037), is an "OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster [that] allows an unauthenticated attacker with permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input." The high-severity flaw, tracked as [CVE-2026-33691](https://nvd.nist.gov/vuln/detail/CVE-2026-33691), allows whitespace padding in filenames to bypass file upload extension checks. These vulnerabilities affect Progress Kemp LoadMaster: GA v7.2.63.1 and older, and LTSF v7.2.54.17 and older. Proof-of-concept code for CVE-2026-8037 was published on June 29, and the same day security researchers at eSentire [reported](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037) active exploitation (although these attempts were not successful). The report notes the following IPs as being the source of the attack: *.ip:(192.42.116.58 OR 192.42.116.105 OR 146.70.139.154) It should be noted that these IPs are VPN/TOR nodes and are widely known for scanning and other exploitation traffic. However, any organizations running vulnerable versions of Kemp LoadMaster during this timeframe should investigate traffic from these IP addresses. - [https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691](https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691) - [https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037) - [https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html](https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html)    ### **CISA KEV Additions** The following vulnerabilities were added to [CISA's](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) Known Exploited Vulnerabilities Catalog in the last 2 weeks: - [CVE-2026-48939](https://www.cve.org/CVERecord?id=CVE-2026-48939) - iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability  - [CVE-2026-56291](https://www.cve.org/CVERecord?id=CVE-2026-56291) - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability  - [CVE-2026-48282](https://www.cve.org/CVERecord?id=CVE-2026-48282) - Adobe ColdFusion Path Traversal Vulnerability  - [CVE-2026-56290](https://www.cve.org/CVERecord?id=CVE-2026-56290) - Joomlack Page Builder Improper Access Control Vulnerability  - [CVE-2026-55255](https://www.cve.org/CVERecord?id=CVE-2026-55255) - Langflow Authorization Bypass Through User-Controlled Key Vulnerability  - [CVE-2026-48908](https://www.cve.org/CVERecord?id=CVE-2026-48908) - JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability  - [CVE-2026-45659](https://www.cve.org/CVERecord?id=CVE-2026-45659) - Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability  - [CVE-2026-48558](https://www.cve.org/CVERecord?id=CVE-2026-48558) - SimpleHelp Authentication Bypass Vulnerability     This report is provided FREE to the cybersecurity community. Visit our [Cyber Threat Intelligence Blog](https://packetwatch.com/resources/threat-intel) for additional reports. Visit our [Cyber Threat Profile Blog](https://packetwatch.com/resources/threat-profile) for detailed intelligence profiles. Visit our [Beyond the Threat Feed Blog](https://packetwatch.com/resources/beyond-the-threat-feed) for more articles.   Subscribe to be notified of future Reports: NOTE We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content. [View full post](https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-07-13-2026) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "PacketWatch Team Sixty43" }, "dateModified" : "2026-07-16T20:09:29.198Z", "datePublished" : "2026-07-14T00:52:46Z", "headline" : "Cyber Threat Intelligence Report", "image" : { "@type" : "ImageObject", "height" : 629, "url" : "https://23540019.fs1.hubspotusercontent-na2.net/hubfs/23540019/2026-07-13-PacketWatch-Cyber-Threat-Intelligence-Featured.webp", "width" : 1200 }, "mainEntityOfPage" : "https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-07-13-2026", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "PacketWatch Threat Intelligence" } } ```