Daily digest

Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

Microsoft disclosed CVE-2026-69836, a maximum-severity remote code execution flaw in Entra ID (formerly Azure AD), confirming it has been exploited in the wild. Microsoft says the issue has been mitigated on its end and no customer action is required.

Why it matters: Entra ID underpins your M365 GCC High identity plane; even with 'no action required,' review sign-in and audit logs for anomalous activity during the exploitation window and confirm conditional access/MFA enforcement remains intact.

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

A code injection vulnerability in GitLab (CVSS 9.4) is being actively exploited just days after disclosure, according to watchTowr. The flaw allows unauthenticated attackers to modify or delete data in publicly accessible GitLab projects without authentication.

Why it matters: If GitLab is used for Ansible playbook or IaC repositories, patch immediately and audit for unauthorized commits or deletions given the speed of exploitation.

Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0

Cisco released patches for nine vulnerabilities across Crosswork Data Gateway, Network Controller, Planning, and Secure Workload Software, five of which scored a maximum CVSS of 10.0. The flaws affect on-prem deployments regardless of configuration, and Cisco says even SaaS customers need to apply updates.

Why it matters: If Cisco network automation or Secure Workload tooling touches your Nutanix/network segmentation, these unauthenticated max-severity flaws warrant immediate patching regardless of SaaS vs on-prem deployment.

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

Citrix patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass affecting customer-managed deployments, FIPS/NDcPP builds, and SecurAccess integrations.

Why it matters: FIPS/NDcPP-validated builds are common in DoD/CMMC environments for remote access; an auth bypass here directly threatens boundary controls required under NIST 800-171.

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project removed malicious versions of three crates (arrayref, internment, append-only-vec) from crates.io after a compromised maintainer account published releases whose build scripts downloaded and executed remote payloads during compilation. Combined, the affected crates have over 245 million downloads.

Why it matters: Any Rust-based tooling in your CI/CD or self-hosted AI stack pipelines should be checked against these poisoned crate versions — build-time execution can bypass typical endpoint controls.

CISA Orders Feds to Patch Actively Exploited TrueConf Server Flaws

CISA added two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform to its Known Exploited Vulnerabilities catalog, directing federal agencies to prioritize patching.

Why it matters: KEV additions carry binding remediation timelines for federal agencies and are a de facto expectation for contractors under CMMC vulnerability management practices — confirm TrueConf isn't in your environment or patch immediately if it is.

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

The U.S. government warned of an active threat using AI-generated exploit scripts, disguised as legitimate monitoring tools, to conduct reconnaissance against Siemens S7 Series PLCs in critical infrastructure organizations.

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three suspected Russian espionage clusters (UNC6293, UNC7005, UNC5976) are abusing legitimate OAuth and WhatsApp device-linking flows to target individuals in academia, aerospace/defense, government, and think tanks across Europe and the U.S.

Why it matters: OAuth-consent phishing bypasses password/MFA controls and is a known vector against Entra/M365 tenants; review app consent policies and restrict user consent for third-party OAuth apps in GCC High.

Pausing CMMC Cannot Mean Pausing Accountability

A DefenseScoop op-ed argues that any pause in CMMC rollout should not stop accountability, proposing an enterprise model combining formalized independent assessment, continuous external monitoring, and shared remediation support for small suppliers.

Why it matters: Signals continued pressure toward continuous monitoring models rather than point-in-time assessments — worth tracking as it may shape future CMMC L2 assessment cadence and documentation expectations.

NRO Looks to Illuminate Supply Chain Risks

The National Reconnaissance Office is working with prime contractors to identify and address supply chain risks, an effort that officials say could inform broader federal supply chain risk management approaches.

Why it matters: Supply chain risk management (SR domain) is a CMMC L2/NIST 800-171 control area; approaches piloted here often trickle down into DFARS and CMMC assessment guidance for the broader defense industrial base.

AWS Network Firewall Now Supports Rule Hit Count

AWS Network Firewall added a rule hit count feature that lets security teams see which firewall rules are actively matching traffic versus dormant, without manual log analysis.

Why it matters: Useful for GovCloud environments needing to demonstrate rule justification and prune stale firewall rules to satisfy NIST 800-171 access control and configuration management requirements.

Who Got Missed in the MFA Rollout? More PowerShell + Graph + Entra Scripting

A SANS ISC diary walks through PowerShell scripts using the Microsoft Graph beta module to identify accounts still missing MFA enrollment during an ongoing rollout, offering a faster alternative to manually reviewing accounts in the admin portal.

Why it matters: Directly applicable for auditing MFA coverage gaps across an Intune/Entra-managed fleet, a common CMMC L2 assessment finding (IA.L2-3.5.3).