Two Critical Vulnerabilities Demand Action Before Friday

On 10 July 2026, two critical vulnerabilities require immediate attention from UK small businesses. CVE-2026-58123, affecting Hermes WebUI, scores 9.8 on the CVSS scale and permits unauthenticated remote code execution through four HTTP requests with no credentials required. CVE-2026-58122, rated 9.1, allows attackers to bypass local-origin protections and conduct server-side request forgery. Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender elevation-of-privilege flaw with publicly available exploit code since 10 June, but the patch may cause disk space exhaustion on affected machines. This episode examines why security and infrastructure tools have become primary attack vectors, analyses the 30-day window between exploit publication and patch availability, and provides five specific actions to complete before the end of the week. Host Corrine Jefferson explains how documented vulnerability response creates competitive advantage in procurement conversations and demonstrates security posture to clients with supply chain requirements.

Chapters

• Intro Two critical vulnerabilities published this week demand action before Friday. One permits unauthenticated remote code execution, the other patches a serious Windows flaw but may silently fill hard drives.
• Hermes WebUI: A 9.8-Rated Hole With No Lock on the Door CVE-2026-58123 and CVE-2026-58122 affect Hermes WebUI, an open-source interface for running large language models locally. The first vulnerability, rated 9.8, allows unauthenticated remote code execution through four HTTP requests. The second, rated 9.1, bypasses local-origin restrictions and enables server-side request forgery, API key theft, and persistent token generation.
• CTA Follow the show, leave a rating or review, and share with other small business owners.
• Windows Defender: The Patch That Might Break Your Machine While Fixing It Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender elevation-of-privilege vulnerability with publicly available exploit code since 10 June. The patch may cause disk space exhaustion on affected machines. Businesses must apply the update and then check disk utilisation on every Windows endpoint.
• The Pattern: Security Tools Are the Target Both vulnerabilities involve security and infrastructure tooling rather than business applications. Attackers target tools with elevated access and trusted network positions. Security tools require the same scrutiny as any other networked component.
• Why This Gives You an Edge Most UK small businesses do not track vulnerability disclosures or correlate patches with potential incidents. Demonstrating documented vulnerability response creates competitive advantage in procurement conversations, particularly with clients requiring supply chain security evidence.
• What To Do Before Friday Five specific actions: check for Hermes WebUI and update to version 0.51.788 or take offline; apply Windows Defender update; check disk space after patching; obtain written MSP confirmation; document all response actions for future evidence requirements.
• Outro Tools with the highest access levels are increasingly targeted first. Patch Hermes WebUI, apply the Defender update, check disk space, obtain MSP confirmation, and document actions taken.

Links

• https://nvd.nist.gov/vuln/detail/CVE-2026-58123
• https://nvd.nist.gov/vuln/detail/CVE-2026-58122
• https://nvd.nist.gov/vuln/detail/CVE-2026-50656
• https://arstechnica.com/security/2026/07/microsoft-defender-patch-disk-space/
• https://www.huntress.com/blog/dragonforce-ransomware-citrix-netscaler