SURIQ
A doubled slash. Two characters in a request path are all it takes to walk back through the fix Fortinet shipped to keep intruders out of its firewalls. On July 27 CISA added that bypass, CVE-2025-68686, to its Known Exploited Vulnerabilities catalog. It carries a mild 5.3 severity, and it is one of the most instructive entries of the week, because it does not open a door. It re-opens one a patch was supposed to have shut.
We logged a decision on roughly 4,200 vulnerabilities this week and flagged around 47 with a sign of active exploitation, by our tracking. Reading the exploited handful in a row, the common thread was not severity, and it was not a single bug class. It was timing. In every case that mattered, the vendor had a fix, and the fix was not where the incident ended. Patch Tuesday trains defenders to treat the update as the finish line. This week produced four clean counterexamples, each showing a different thing a patch does not do.
From a desk that watches these servers after the patch as closely as before it, the pattern is familiar, and it is the part a severity score was never built to price. A CVSS number rates how bad the hole is. It says nothing about whether the hole was already used, whether closing it removes the intruder, or whether it will reopen next quarter. Those are the questions that decide whether "patched" and "safe" are the same sentence, and this week, four times over, they were not.
The fix you can step around
Start with the FortiGate bypass, because it is the cleanest case. Fortinet had already patched the original symbolic-link trick that let intruders keep reading a compromised firewall's files. CVE-2025-68686 is a bypass of that patch: a doubled slash in the SSL-VPN language path restores the same read access for an attacker who already has a foothold on the device. It helps no one who is not already inside, which is exactly why it is easy to under-rate. If a FortiGate was internet-facing during the 2023 to 2025 SSL-VPN attacks, a foothold planted then can be reading its configuration and secrets today, on a box whose owner believes the matter was closed last year. Upgrading to FortiOS 7.6.2 or 7.4.7 shuts the current path. It does nothing about what the earlier one already read.
The fix that does not evict
Microsoft shipped three on-premises SharePoint remote-code-execution fixes in July. CVE-2026-50522, a CVSS 9.8 deserialization flaw, went from public proof of concept to active exploitation within hours, and it steals the server's ASP.NET machine key on the way through. That key signs and encrypts the tokens SharePoint trusts. An attacker who took it before you patched can forge requests that a fully updated server still honors. All three of July's SharePoint bugs end in the same key theft, which is why the update is only half the job: until you rotate the machine key, the intruder keeps a valid credential to a patched server. The hole is closed and the lock still opens. It was the third SharePoint fix many administrators applied in a single month, and the step that actually evicts the attacker, rotating the key, is the one the release notes will not perform for you.
The fix you cannot confirm worked
The hardest gap to close is the one you cannot see. Check Point's CVE-2026-16232, added to CISA's catalog on July 22, lets an unauthenticated attacker who can reach a Security Management server obtain a valid administrative login token and sign in through SmartConsole with full control of every managed gateway's policy. Because the attacker holds a legitimate token, there is no failed-login trail, no brute-force noise, nothing the box itself would flag. Patching removes the way in. It does not tell you whether that way was used in the days the server sat exposed, and the server's own logs never will. The only signal that separates a clean install from an owned one lives a layer out: an administrative session from a source address outside your management range, a policy change nobody authorized. That is the difference between patching and knowing, and this bug is why the two are not the same word.
The fix that is not final
Some fixes do not stay fixed. CVE-2026-0770, an unauthenticated root RCE in Langflow's validate endpoint, reached CISA's catalog on July 21. It is the second exploited root RCE in that same endpoint in a year; the first reached the catalog in May 2025. A surface that produces a known-exploited entry annually is not a bug you patch and forget, it is a liability you plan around. And a fix only helps if you know to apply it. A self-managed GitLab code-execution flaw shipped on June 10 as an unlabeled bug fix, with no CVE and no severity score, until a working exploit surfaced in July. A triage queue sorted by CVSS never saw it, because it had no CVSS to sort by. When it does execute, it does so with the privileges of the git service account, which can reach every repository, the Rails secret keys, and connected-service credentials, a near-total takeover launched from an account many teams hand out freely.
What "patched" has to mean now
None of this is an argument against patching quickly. It is an argument that "patched" is a status the update earns, not one it grants. For anything exploited before you closed it, assume the window was used and act on that. After a secret-stealing RCE like SharePoint or Langflow, rotate the keys the attacker could have taken, not just the software version; a patched server holding a stolen key is still an open one. For an appliance that was internet-facing during a known campaign, treat it as previously breached: diff its running configuration against a known-good copy, rotate its stored credentials, and ship its logs somewhere it cannot edit.
For the intrusions a patch cannot prove clean, put the detection a layer out, where the box's own logs cannot cover for the attacker: an admin session from outside your management network, egress an appliance should never produce, a service reaching for cloud-metadata it has no reason to want. And for a surface that keeps returning, like Langflow's validate endpoint, stop treating each CVE as closure and stand a control in front of it, off the public internet and behind authentication, so the next one lands on a wall instead of a shell. The patch is the moment the work becomes visible. It is not the moment it ends.
Methodology: figures are drawn from the Suriq threat desk's own intelligence and news ledgers over the stated window. "Triaged" counts events we logged a decision on, not raw signal volume; exploitation figures are best-effort and labelled approximate.