Assess promptly

Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in

Patch now

WordPress 7.0.2 addresses two serious security issues, including a flaw chain that could lead to remote code execution on affected installations.

Update promptly

Google released Chrome 150.0.7871.128/129 with seven security fixes, led by a critical use-after-free vulnerability in CameraCapture.

Assess and update

Cisco's July advisory bundle includes a RoomOS hardening release with multiple high-severity issues and a separate Identity Services Engine path-traversal vulnerability.

Review access design

Google Cloud corrected a Developer Connect privilege-escalation path by requiring both the calling principal and the service agent to hold permission on referenced secrets.

Review exposure

Google mitigated CVE-2026-14934, a missing-authorization issue that could enable cross-tenant repository takeover in BigQuery, Dataform and Colab Enterprise workflows.

Patch self-managed hosts

Google disclosed CVE-2026-53359, a KVM use-after-free that could let a nested virtual machine cross the hypervisor boundary, and deployed live host hotpatches across managed Compute Engine.

Upgrade affected products

Cisco released fixes for ClamAV vulnerabilities, including CVE-2026-20216, that can let a crafted file terminate scanning and consume system resources.

Assess affected proxies

Google Cloud warned that blocked QPACK decoding in Envoy can trigger denial of service against the HTTP/3 stack, affecting some Cloud Service Mesh deployments.

Review WAF guidance

AWS published guidance for CVE-2026-13762 and CVE-2026-13763 involving inspection of HTTP/2 requests distributed across multiple frames.

Update managed devices

Apple's security releases page lists iOS and iPadOS 26.5.2, giving mobile administrators a new baseline to verify across supported devices.

Deploy and verify

Apple released macOS Tahoe 26.5.2 and updated its official security-release inventory for supported Mac systems.

Update supported Macs

Apple listed Safari 26.5.2 among its June 29 security releases, making browser-version verification part of the current Mac patch cycle.

Check legacy tasks

Google Cloud published guidance for CVE-2025-0982 in the Rhino JavaScript engine used by Application Integration tasks published before January 2025.