New InfraTrust report reveals infrastructure flaws admins should patch first

Eclypsium has released a new infrastructure security report highlighting critical vulnerabilities affecting widely used networking and infrastructure devices. The inaugural July 2026 InfraTrust Pulse report outlines 61 advisories from 14 vendors, including six critical flaws and 26 remotely exploitable vulnerabilities. Several of these issues are being actively exploited by threat actors like Volt Typhoon and Salt Typhoon. Notably, SonicWall’s SMA1000 appliances (CVE-2026-15409 and CVE-2026-15410) were exploited before patches were available, while Fortinet’s FortiSandbox faced command injection flaws later added to CISA’s KEV catalog. Eclypsium emphasizes prioritizing vulnerabilities based on exploitability and exposure rather than just CVSS scores.