Thursday, July 2, 2026
Daily digest
Two high-priority items demand immediate attention today: a SharePoint RCE (CVE-2026-45659) is being actively exploited and is now on the CISA KEV, and the FortiBleed credential-theft campaign has been directly tied to INC and Lynx ransomware operators — both have concrete action items for this environment.
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA added CVE-2026-45659, a CVSS 8.8 remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The vulnerability stems from deserialization of untrusted data and was patched in May 2026. Federal agencies under BOD 22-01 are required to remediate KEV entries on a mandated timeline.
Why it matters: If your environment runs any on-premises SharePoint Server instances (including hybrid configurations alongside M365 GCC High), verify the May patch has been applied — KEV addition triggers BOD 22-01 remediation deadlines and is directly relevant to CMMC AC/SI controls requiring timely patching.
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
Researchers have attributed the FortiBleed mass credential-theft campaign targeting FortiGate devices to operators affiliated with both INC and Lynx ransomware groups. An operator tied to FortiBleed's infrastructure was found actively working negotiation panels for both groups, establishing a direct pipeline from stolen Fortinet VPN credentials to ransomware deployment. The campaign harvested credentials at scale for use in follow-on network intrusions.
Why it matters: If FortiGate appliances are part of your perimeter or VPN stack, rotate all credentials, audit for indicators of compromise, and verify firmware is current — stolen creds from this campaign are being directly handed off for ransomware deployment, not just sold.
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack End-to-End
Sysdig's Threat Research Team documented what it believes is the first ransomware attack fully orchestrated by an AI agent, attributed to a threat actor they call JADEPUFFER. The AI agent used a Langflow RCE vulnerability to gain initial access, then autonomously handled credential theft, lateral movement, and final encryption and wiping of a production database. No human operator directed the individual attack steps.
Why it matters: If Langflow or any other self-hosted AI orchestration framework is running in your environment (relevant given your self-hosted AI stack), treat it as a high-priority patch and attack-surface review target — this is the first confirmed case of an AI agent autonomously executing a full ransomware kill chain.
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Synacktiv disclosed an unpatched, unauthenticated remote code execution vulnerability in Argo CD's repo-server component that can be reached via the component's internal network port. The firm states the flaw is capable of leading to a full Kubernetes cluster takeover and has no CVE assigned and no available fix. Synacktiv reported the issue to Argo CD maintainers, but no patch timeline has been published.
Why it matters: If Argo CD is part of your Kubernetes or container deployment pipeline, immediately audit whether the repo-server port is exposed beyond strictly necessary internal network segments and consider compensating controls — there is no patch available, making network isolation the only mitigation right now.
Cisco Confirms Active Exploitation of Unified Communications Manager Vulnerability
Cisco officially confirmed that attackers are actively exploiting a vulnerability in Unified Communications Manager (Unified CM) that was patched in early June 2026. The company had previously been silent on exploitation status despite reports of attempts in the wild. No additional technical details about the exploitation method were released alongside the confirmation.
Why it matters: If Cisco Unified CM is in your voice/collaboration infrastructure, the June patch should be treated as emergency remediation — confirmed active exploitation means exposure time is critical.
Hackers Target Microsoft 365 Accounts With 81 Million Login Attempts
A large-scale password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. The campaign systematically targeted M365 tenants using credential stuffing and low-and-slow spray techniques designed to evade standard lockout thresholds. No specific sector targeting was disclosed, but the scale suggests broad opportunistic targeting.
Why it matters: Your M365 GCC High tenant is a plausible target for this campaign; verify Entra ID sign-in logs for spray patterns, confirm MFA enforcement via Intune Conditional Access covers all users including service accounts, and review anomalous authentication alerts from the relevant timeframe.
DHS Confirms Hackers Breached HSIN Information-Sharing Platform
The Department of Homeland Security confirmed a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector security partners. An investigation is underway, but DHS has not publicly disclosed the attack vector, the scope of data accessed, or attribution. HSIN is used to share sensitive but unclassified threat and incident information across government and critical infrastructure sectors.
Why it matters: If your organization has HSIN accounts or personnel who use the platform for threat-sharing, treat those credentials as potentially compromised and rotate them — the breach scope is not yet confirmed, and any shared threat intelligence or operational details posted to HSIN may have been exposed to the attacker.
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029
Microsoft announced it is accelerating its post-quantum cryptography migration roadmap, citing faster-than-expected advances in quantum computing that have shifted the risk horizon. Azure CTO Mark Russinovich stated that Microsoft now targets completing the transition away from classical encryption standards by 2029, ahead of prior estimates. The announcement covers Azure services and Microsoft's broader product portfolio.
Why it matters: NIST 800-171 Rev 3 and emerging CMMC guidance are expected to incorporate post-quantum cryptography requirements; Microsoft pulling its timeline to 2029 means your GCC High-dependent workflows will face algorithm transitions sooner — start inventorying cryptographic dependencies (TLS configs, VPN ciphers, key storage) now to avoid a compliance scramble.
EvilTokens Device-Code Phishing Kit Is a Complete BEC Operations Environment
Cisco Talos researchers revealed that the EvilTokens phishing kit is significantly more capable than initially understood, describing it as a full business email compromise operations environment rather than a simple credential harvester. The kit weaponizes OAuth device-code authentication flows to steal tokens without requiring victims to enter passwords, and includes infrastructure for managing compromised accounts at scale. Device-code phishing is particularly effective against MFA-protected accounts because it abuses a legitimate authentication flow.
Why it matters: M365 GCC High tenants are prime targets for device-code phishing because the technique bypasses standard MFA — verify that Conditional Access policies in your Entra ID tenant explicitly block or require compliant device registration for device-code authentication flows, and consider disabling device code flow for users who don't require it.
Adobe Patches Seven CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Adobe released emergency patches resolving seven maximum-severity (CVSS 10.0) vulnerabilities across Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion flaws can lead to arbitrary code execution, privilege escalation, arbitrary file system reads, and security feature bypass. Campaign Classic vulnerabilities carry similar severity ratings, though specific exploitation details were not disclosed at time of publication.
AWS Network Firewall Now Supports Container Attribute-Based Rules for EKS and ECS
AWS announced that Network Firewall now supports container attribute-based rules, allowing security policies to be scoped to specific EKS pods or ECS tasks rather than just IP addresses or ports. The feature enables fine-grained east-west traffic controls for containerized workloads including AI/ML inference pipelines and RAG stacks running on EKS. Rules can reference container metadata such as image name, task definition, or namespace.
Why it matters: For AWS GovCloud container workloads, this feature directly supports CMMC SC.3.177 and related network segmentation controls — you can now enforce microsegmentation at the container level without requiring a service mesh, which is relevant if you're running inference or data-processing workloads in EKS.
Progress Kemp LoadMaster Pre-Auth RCE Flaw Under Active Exploitation
eSentire's Threat Response Unit identified active exploitation attempts targeting CVE-2026-8037, a CVSS 9.6 pre-authentication OS command injection flaw in Progress Kemp LoadMaster load balancers. The vulnerability requires no credentials and allows remote code execution on the appliance. A patch has been released by Progress, but exploitation began before widespread remediation.