Skip to content
Krypteia Sec
Back to Threat Intel
TLP:CLEARCTI-2026-0701

Daily Threat Intelligence Brief - July 1, 2026

Citrix NetScaler CVE-2026-3055 under mass exploitation for SAML identity theft, Oracle PeopleSoft zero-day CVE-2026-35273 (CVSS 9.8), record 200+ CVE June Patch Tuesday with six zero-days, the Klue OAuth supply-chain breach hitting LastPass and Huntress, and prompt injection surging 340% year over year.

By The Operator·July 1, 2026·14 min read
ctivulnerabilitiesransomwareai-securityagentic-aithreat-actors

The Operator's Take

The signal this week is not a shell, it is a credential. The two loudest events, Citrix NetScaler CVE-2026-3055 and the Klue supply-chain breach, are both identity attacks wearing different costumes. NetScaler is only a memory overread, no code execution, yet attackers are exploiting it at scale precisely because a device configured as a SAML identity provider leaks the authentication material needed to impersonate any federated user. Klue was the same shape from the other direction: stolen OAuth tokens cascaded through Salesforce integrations into roughly two dozen downstream customers including LastPass and Huntress. Treat "no RCE" as "low priority" this week and you will miss the more dangerous class of bug, because a read primitive that yields SAML signing artifacts federates across your entire estate while a root shell sits on one box.

The connection extends into the AI column. The lethal trifecta driving agentic risk, private data plus untrusted content plus tool access, pays out in exactly the same currency: a successful prompt injection no longer just produces bad text, it hijacks an agent's planning and spends its tokens and tool grants. Identity is the crown jewel across all three stories. This week, rotate before you patch where you can: force SAML signing-key rotation on any internet-facing NetScaler, revoke and reissue third-party OAuth tokens tied to SaaS integrations, and audit every MCP tool description your agents trust as executable content. Patching the appliance does not un-leak a key that already left the building.

Executive Summary

  • Citrix NetScaler CVE-2026-3055 (CVSS 9.3), an unauthenticated memory overread on appliances configured as SAML identity providers, is under confirmed large-scale exploitation for authentication-artifact theft. NVD
  • Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), an unauthenticated remote code execution flaw, was exploited as a zero-day between May 27 and June 9, 2026, before the vendor alert. Rapid7
  • June 2026 Patch Tuesday set a record with more than 200 CVEs and six zero-days, including the HTTP/2 flaw CVE-2026-49160 and the CVE-2026-47281 "RoguePlanet" SYSTEM privilege escalation. BleepingComputer
  • Chrome V8 zero-day CVE-2026-11645 (out-of-bounds read and write) is actively exploited and now sits in the CISA KEV catalog. The Hacker News
  • Fortinet FortiSandbox CVE-2026-39808 and CVE-2026-39813 (both CVSS 9.8) allow unauthenticated RCE, and a public proof of concept exists for the former. Greenbone
  • The Klue OAuth supply-chain breach (claimed by the actor "Icarus") reached roughly two dozen customers including LastPass, Huntress, Recorded Future, Tanium, Jamf, and HackerOne via compromised legacy credentials and integration tokens. SharkStriker
  • Prompt injection remains OWASP's number one LLM risk, appearing in an estimated 73% of production AI deployments, with attack volume up 340% year over year. Kunal Ganglani
  • CISA KEV added multiple exploited flaws in June, spanning Cisco Catalyst SD-WAN, Arista EOS, Ubiquiti UniFi OS, the Linux kernel, and Android. CISA
  • Adversary breakout time compressed to roughly 72 minutes from foothold to active exfiltration, a fourfold reduction that shortens the window for containment. The Security Bench

Critical Vulnerabilities

CVE-2026-3055: Citrix NetScaler ADC and Gateway Memory Overread

A critical out-of-bounds read (CVSS 9.3) in NetScaler ADC and NetScaler Gateway lets an unauthenticated remote attacker leak sensitive memory from the appliance. Exploitation is configuration-dependent: the device must be running as a SAML identity provider, a common posture in enterprise single sign-on and cloud federation. Fortinet's threat intelligence team has confirmed large-scale exploitation against internet-facing NetScaler appliances. This is not code execution, but the leaked authentication artifacts let attackers impersonate legitimate users at scale, which for a federation hub is arguably worse than a single-host shell. Patch immediately, then rotate SAML signing keys and any session material that could have been read. Citrix | Horizon3.ai | NCSC

CVE-2026-35273: Oracle PeopleSoft Unauthenticated RCE

A critical flaw (CVSS 9.8) in the Oracle PeopleSoft Updates Environment Management component is remotely exploitable without authentication. Mandiant reported active exploitation as a zero-day before the vendor security alert, with observed activity between May 27 and June 9, 2026. PeopleSoft carries HR, payroll, and financials data for large enterprises and public-sector bodies, making it a high-value target for both espionage and extortion. Apply the Oracle fix and hunt for post-exploitation persistence in any environment that was internet-reachable during the exposure window. Rapid7

CVE-2026-47281: Windows Defender "RoguePlanet" SYSTEM Privilege Escalation

A zero-day privilege escalation (CVSS 9.6) tied to Microsoft Defender and Visual Studio Code was under active exploitation and addressed in the June Patch Tuesday cycle. An attacker who already holds code execution can escalate to SYSTEM, the highest privilege on Windows, turning a foothold into full host control. This chains naturally behind phishing or a browser exploit, so treat it as a second-stage enabler and prioritize endpoints where developers run VS Code. Threat-Modeling.com

CVE-2026-49160: HTTP/2 "Bomb" Zero-Day

One of three headline zero-days in the June Patch Tuesday, this HTTP/2 flaw was disclosed alongside a record 200-plus CVE release, 32 of them rated critical. The June cycle marks what analysts are calling the "new normal" of 200-plus monthly fixes, partly attributed to AI-assisted vulnerability research accelerating discovery on both sides. Prioritize by exploited-in-the-wild status, not raw count. SOCRadar | The Hacker News

CVE-2026-11645: Chrome V8 Out-of-Bounds Read and Write

An actively exploited zero-day in Chrome's V8 JavaScript engine, now in the CISA KEV catalog. This is at least the fifth exploited Chrome zero-day patched in 2026, a reminder that the browser remains the most-attacked initial-access surface. Force-update Chrome and Chromium-based browsers across the fleet and confirm the update actually applied rather than merely staged. The Hacker News

CVE-2026-39808 and CVE-2026-39813: Fortinet FortiSandbox Unauthenticated RCE

Two critical FortiSandbox flaws (both CVSS 9.8) allow unauthenticated remote code execution. A public proof of concept for CVE-2026-39808 raises the exploitation risk from theoretical to imminent. Security appliances are attractive targets because they sit deep in the network and often escape endpoint monitoring. Patch FortiSandbox now and restrict management-plane exposure. Greenbone | Integrity360

CVE-2026-20245: Cisco Catalyst SD-WAN Manager

Added to CISA KEV in June, this improper output-encoding flaw lets an authenticated attacker with network-admin access run root commands and push unauthorized configurations. It is reported as the seventh exploited Cisco Catalyst SD-WAN zero-day of 2026, a pattern that should prompt a broader review of SD-WAN management-plane exposure and admin-credential hygiene. The Hacker News

June CISA KEV Round-Up: Widely Embedded Infrastructure

Several exploited flaws across common infrastructure were catalogued in June and carry federal remediation deadlines that make a sensible bar for everyone:

CVE Product Type KEV Date
CVE-2026-7473 Arista EOS Incomplete comparison (auth bypass class) Jun 9
CVE-2026-34908 Ubiquiti UniFi OS Improper access control Jun 23
CVE-2026-34909 Ubiquiti UniFi OS Path traversal Jun 23
CVE-2026-34910 Ubiquiti UniFi OS Improper input validation Jun 23
CVE-2022-0492 Linux kernel Improper authentication (cgroups) Jun 2
CVE-2025-48595 Android Framework Integer overflow Jun 2
CVE-2025-67038 Lantronix EDS5000 Code injection Jun 23

Sources: CISA Jun 9, CISA Jun 23, CISA Jun 2

AI Security Threats

The center of gravity in AI security has moved from model output to agent action. A year ago a successful prompt injection produced bad text. Today, against a tool-using agent, the same injection hijacks the agent's planning loop, invokes privileged tools, persists malicious instructions in memory, and can propagate across connected systems. That amplification is why the numbers are climbing.

Prompt injection is still OWASP's number one LLM risk in 2026. Security audits place prompt injection in an estimated 73% of production AI deployments, and attack volume has climbed roughly 340% year over year, the fastest-growing single category of attack by that measure. OpenAI has publicly described it as a frontier security challenge with no clean solution, which is the honest framing: mitigation, not elimination. Kunal Ganglani | AI Magicx

The lethal trifecta defines the real risk boundary. The dangerous combination is private data access, exposure to untrusted content, and the ability to act through tools. Any agent that holds all three is exploitable, and most useful agents are built to hold all three. The defensive move is to break the triangle: strip one leg for a given task rather than trusting the model to resist manipulation. Airia

MCP tool descriptions are a trusted-content blind spot. A malicious MCP server can embed injection payloads directly in tool descriptions. Because those descriptions are typically treated as trusted configuration rather than untrusted input, they bypass most content filtering entirely. As enterprises adopt MCP for agent connectivity, every third-party server becomes part of the trust boundary and deserves the same scrutiny as a signed dependency. Christian Schneider

RAG pipelines are an injection delivery vector. In retrieval-augmented generation, an attacker who can plant a document in the knowledge base embeds instructions that fire when a user asks a related question. The knowledge base is now an attack surface, not a passive store, which means ingestion needs the same provenance controls you would apply to code. AI Security Newsletter, June 2026

Software supply chain meets AI-scaled tradecraft. June saw a supply-chain campaign affecting 144 npm packages, and AI-generated content now features in the majority of state-sponsored phishing operations. The tooling that speeds up defensive vulnerability research, visible in the record June Patch Tuesday, cuts equally for the attacker. Industrial Cyber

For teams running or testing agents, agentic red teaming is the discipline that surfaces these failure modes before an adversary does: adversarial inputs against the full tool-calling loop, not just the chat interface.

Threat Actor Activity

Nation-state operations in mid-2026 continue to blur espionage and financially motivated activity, and breakout time keeps shrinking. The 2026 benchmark for adversary breakout, foothold to active exfiltration, is roughly 72 minutes, a fourfold reduction from prior-year averages. That number should reset every containment SLA that still assumes hours. The Security Bench

Actor Attribution Recent Activity
Salt Typhoon China (PRC-linked) Targeted U.S. House committee staff email, focused on national-security personnel
APT41 / Brass Typhoon China Shifted toward financially motivated operations against the gambling and gaming sector
APT28 Russia (GRU-linked) Targeted transportation, logistics, and technology entities for intelligence collection
APT33 / APT34 / APT39 Iran Targeted agencies, energy producers, and critical infrastructure across North America, Europe, and the Middle East

Across the 2025-2026 window, state-sponsored actors were tied to 297-plus documented supply-chain attacks, intrusions at 200-plus telecom operators across six continents, and at least four new wiper families deployed against Ukrainian infrastructure. The common thread is upstream position: compromise one supplier or one identity provider and inherit the trust of everyone downstream. Sources: CloudSEK | RH-ISAC | Trend Micro

Ransomware and Data Breaches

June delivered a run of high-profile incidents, led by an OAuth-token supply-chain breach that turned one vendor compromise into a multi-company event.

Victim Actor / Group Impact Vector
Klue (and ~24 customers) Icarus Salesforce CRM data across customers including LastPass, Huntress, Recorded Future, Tanium, Jamf, Gong, Sprout Social, HackerOne Compromised legacy credentials, stolen OAuth tokens (Jun 11 to 12)
University of Nottingham ShinyHunters 10GB-plus exposed, 454,600 unique emails, passports, fee and enrollment records Ransomware and data theft
Nintendo ShadowByt3$ 859MB claimed, employee PII, surveys, internal reports 2016 to 2026 Ransomware and data theft
TVING (South Korea) Undisclosed IDs, names, birthdates, phone numbers, emails, passwords, refund accounts Unauthorized external access (Jun 3)
French Government Tchap "misere" Official government messaging platform breach Unauthorized access (Jun 7)

The Klue event is the one to study. Attackers used compromised legacy credentials to reach the integration environment, then harvested OAuth tokens that granted standing access into connected customer platforms. No customer was individually breached, yet all inherited the exposure through a shared trust relationship. This is the SaaS-integration version of the NetScaler identity problem: the token, not the box, was the payload. Sources: SharkStriker | CM-Alliance | SecurityWeek

Recommended Actions

Immediate (0 to 72 hours)

  • Patch and rotate on NetScaler. Apply the CVE-2026-3055 fix on all NetScaler ADC and Gateway appliances, then rotate SAML signing keys and invalidate active sessions. Assume any internet-facing SAML IDP appliance may have leaked authentication material. Citrix
  • Remediate Oracle PeopleSoft CVE-2026-35273 and hunt for post-exploitation persistence across the May 27 to June 9 exposure window. Rapid7
  • Deploy June Patch Tuesday updates, prioritizing the exploited zero-days CVE-2026-47281 and CVE-2026-49160. BleepingComputer
  • Force-update Chrome and Chromium for CVE-2026-11645 and confirm the version actually applied. The Hacker News
  • Patch FortiSandbox for CVE-2026-39808 and CVE-2026-39813; a public PoC exists. Greenbone
  • Revoke and reissue OAuth tokens for third-party SaaS integrations, especially any tied to CRM or identity platforms, in light of the Klue breach. SharkStriker

Short-Term (1 to 4 weeks)

  • Clear the June CISA KEV backlog: Cisco SD-WAN CVE-2026-20245, Arista EOS CVE-2026-7473, the Ubiquiti UniFi OS trio, and the Linux and Android additions. CISA
  • Inventory every SAML IDP and OAuth trust relationship. Map which appliances issue assertions and which third parties hold standing tokens into your environment. You cannot rotate what you have not inventoried.
  • Audit MCP servers and agent tool definitions. Treat tool descriptions as untrusted input, pin server versions, and review third-party MCP connectors like signed dependencies. Christian Schneider
  • Add provenance controls to RAG ingestion so untrusted documents cannot silently enter the knowledge base. AI Security Newsletter
  • Reset containment SLAs against a sub-72-minute breakout assumption; confirm detection and response can actually meet it. The Security Bench

Strategic (Quarter and beyond)

  • Reclassify vulnerability triage around identity impact, not just RCE. A memory read that leaks federation keys can outrank a single-host shell. Bake this into your severity model.
  • Stand up agentic red teaming as a recurring exercise: adversarial testing of the full tool-calling loop, not just the chat surface, before agents reach production.
  • Design agents against the lethal trifecta. For each agent task, remove one of private-data access, untrusted-content exposure, or tool action rather than trusting the model to refuse manipulation. Airia
  • Harden the SaaS supply chain. Enforce short-lived tokens, least-privilege OAuth scopes, and continuous review of integration trust so one vendor compromise cannot cascade the way the Klue breach did.
  • Plan for the 200-plus CVE monthly cadence. Automate patch prioritization by exploited-in-the-wild status, because manual triage does not scale to the new normal. CSO Online

Sources

ΛKrypteia Sec Research·July 1, 2026