Skip to content
Krypteia Sec
Back to Threat Intel
TLP:CLEARCTI-2026-0707

Daily Threat Intelligence Brief - July 7, 2026

Cisco Catalyst SD-WAN CVE-2026-20182 (CVSS 10.0) exploited by UAT-8616 for admin takeover; SharePoint RCE CVE-2026-45659 added to CISA KEV; FortiBleed exposes credentials for 86,644 Fortinet firewalls across 194 countries; prompt injection holds OWASP LLM01 at 50 to 84 percent success as 88 percent of orgs report AI agent incidents.

By The OperatorJuly 7, 202613 min read
ctivulnerabilitiesransomwareai-securityagentic-aithreat-actors

The Operator's Take

Three of today's top items share one root: the trust we grant to the boxes and tools that sit at the edge of the network is being spent against us. UAT-8616 is not breaking crypto on the Cisco Catalyst SD-WAN controller, it is convincing the controller that an attacker is a peer it should already trust, and FortiBleed is not a new bug at all, it is the harvest of credentials from appliances that organizations assumed were the guards rather than the door. The same pattern is now bleeding into the agent stack: MCP tool poisoning and the nginx-ui MCP flaw (CVE-2026-33032, CVSS 9.8) are the same class of failure, a component trusting metadata or a peer it never authenticated. The non-obvious connection this week is that management-plane appliances and agent tool-chains are converging into the same attack surface, and both are being probed by actors who read source before they scan. Defenders should stop treating the SD-WAN controller, the VPN concentrator, and the MCP server as infrastructure and start treating them as the crown-jewel targets they now are: pull management interfaces off the public internet, rotate every credential that ever transited a Fortinet tunnel, and audit the description field of every tool your agents can call before you audit anything else.

Executive Summary

  • CVE-2026-20182 (CVSS 10.0), an authentication bypass in Cisco Catalyst SD-WAN Controller, is under active exploitation by a sophisticated actor tracked as UAT-8616, allowing remote unauthenticated attackers to become trusted peers and inject SSH keys into admin accounts. Talos
  • CISA added SharePoint RCE CVE-2026-45659 (CVSS 8.8) to the Known Exploited Vulnerabilities catalog on July 1, 2026, with a federal remediation deadline of July 4. The Hacker News
  • The FortiBleed campaign exposed working admin and VPN credentials for 86,644 Fortinet firewalls, roughly half of all internet-facing Fortinet devices, across 194 countries; Fortinet says no new CVE is involved, only weak credential hygiene and legacy hash storage. SecurityWeek
  • Chrome V8 zero-day CVE-2026-11645 (CVSS 8.8), an out-of-bounds memory access, is being exploited in the wild. The Hacker News
  • Citrix NetScaler CVE-2026-3055, a SAML IdP vulnerability, is confirmed under large-scale exploitation. Citrix
  • Prompt injection remains OWASP LLM01 with a 50 to 84 percent success rate and appears in an estimated 73 percent of production AI deployments; 88 percent of organizations reported confirmed or suspected AI agent security incidents in the past year. Kunal Ganglani
  • OpenSSL CVE-2026-45447, a heap use-after-free in PKCS#7 signature verification, can cause heap corruption and possibly remote code execution. Security Affairs
  • Ransomware now appears in 44 percent of all breaches, up from 32 percent the prior year, at an average cost of $5.08M per incident; Qilin hit manufacturer Chemco and Krybit listed Ford Motor Company this week. BlackFog
  • The Armored Likho group used a large language model to generate the loader code for its BusySnake Stealer, targeting government and electric power operators across Russia, Kazakhstan, and Brazil. Industrial Cyber

Critical Vulnerabilities

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass

The highest-priority item today. CVE-2026-20182 carries a maximum CVSS score of 10.0 and affects the vdaemon service over DTLS (UDP port 12346) in Cisco Catalyst SD-WAN Controller, formerly known as vSmart. When a connecting peer claims to be a vHub device, device-type-specific certificate verification does not occur, yet the code path still marks the peer as authenticated. A remote unauthenticated attacker can therefore become an authenticated peer and perform privileged operations, including injecting an attacker-controlled public key into the vmanage-admin account's authorized SSH keys file, a direct path to admin control of the management plane.

Cisco PSIRT became aware of limited exploitation in May 2026, and Cisco Talos now confirms active in-the-wild exploitation clustered under UAT-8616, assessed as a highly sophisticated threat actor. This is distinct from, but adjacent to, the earlier CVE-2026-20127 in the same networking stack. Patch immediately and treat any exposed controller as presumed compromised: audit authorized_keys files and rotate credentials.

Source: Rapid7, Cisco Advisory

CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE

Added to the CISA KEV catalog on July 1, 2026 following confirmed in-the-wild exploitation. CVSS 8.8, a remote code execution flaw from deserialization of untrusted data. Any authenticated attacker with a minimum of Site Member permissions can execute code remotely, no admin rights required. Microsoft patched it in May 2026 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. FCEB agencies were directed to remediate by July 4. On-prem SharePoint remains a favored target because a Site Member foothold is cheap to obtain through phishing or reused credentials.

Source: The Hacker News, CISA

CVE-2026-11645: Google Chrome V8 Zero-Day

A high-severity (CVSS 8.8) out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine, exploited in the wild. Browser-engine zero-days remain the most reliable initial-access vector for drive-by and watering-hole operations because they require no user interaction beyond visiting a page. Force-update Chrome and all Chromium-based browsers. Related V8 and Skia issues (CVE-2026-3910 and CVE-2026-3909) have also seen in-the-wild activity earlier this year.

Source: The Hacker News, SOC Prime

CVE-2026-3055: Citrix NetScaler SAML IdP

A SAML Identity Provider vulnerability in Citrix NetScaler confirmed under large-scale exploitation. SAML flaws are dangerous because a single successful abuse of the IdP undermines federated authentication for every downstream application that trusts it. Apply the Citrix security bulletin fixes and review authentication logs for anomalous assertions.

Source: Citrix, Threat-Modeling.com

CVE-2026-45447: OpenSSL PKCS#7 Heap Use-After-Free

A widely-embedded library flaw that deserves attention despite not being AI-related. CVE-2026-45447 is a heap use-after-free in a function used for PKCS#7 verification, triggerable via a specially crafted PKCS#7 or S/MIME signed message during signature verification. Exploitation can cause heap corruption, process crashes, and possibly remote code execution. Because OpenSSL is embedded in countless appliances, agents, and language runtimes, inventory and patch systematically rather than assuming your OS package update covers every bundled copy.

Source: Security Affairs, OpenSSL

CVE-2026-33032: nginx-ui MCP Command Execution

CVSS 9.8. The nginx-ui MCP message endpoint failed to perform authentication for command execution requests, allowing unauthenticated command execution. This is the infrastructure-and-agentic worlds colliding: an MCP server bolted onto a web-facing management UI with no authentication on the tool-invocation path. Treat every MCP server as an internet-exposed remote-code-execution surface until proven otherwise.

Source: Practical DevSecOps

CVE Component CVSS Status Action
CVE-2026-20182 Cisco Catalyst SD-WAN Controller 10.0 Exploited (UAT-8616) Patch now, audit SSH keys
CVE-2026-45659 Microsoft SharePoint Server 8.8 KEV, exploited Patch, was due July 4
CVE-2026-11645 Google Chrome V8 8.8 Zero-day, exploited Force browser update
CVE-2026-3055 Citrix NetScaler SAML IdP High Exploited at scale Apply bulletin fixes
CVE-2026-45447 OpenSSL PKCS#7 High Patched Inventory bundled copies
CVE-2026-33032 nginx-ui MCP endpoint 9.8 Disclosed Authenticate or remove

AI Security Threats

The AI attack surface matured from theory to routine exploitation this cycle. Prompt injection holds its position as OWASP LLM01, the number-one large language model vulnerability, with attack success rates of 50 to 84 percent depending on system configuration and an estimated presence in 73 percent of production AI deployments. See the KrypteiaSec glossary on prompt injection for the canonical definition and taxonomy.

The scale problem is now measurable. Per the Cisco State of AI Security 2026 report, 83 percent of organizations plan to deploy agentic AI but only 29 percent feel ready to do so securely, and a separate 2026 enterprise survey found that 88 percent of organizations reported confirmed or suspected AI agent security incidents in the past year. The mechanism of harm has changed shape: in a single-shot LLM, a successful injection produces one manipulated output; in an agent with tool access, that same injection becomes an orchestrated multi-tool kill chain, which is why the industry now treats agentic red teaming as distinct from classic model evaluation.

Production-grade CVEs confirm the theory. Critical prompt-injection and code-execution flaws landed in Microsoft Copilot (CVSS 9.3), GitHub Copilot (CVSS 9.6), and Cursor IDE (CVSS 9.8) across 2025 and 2026, and researchers note that no complete fix exists: even frontier models from OpenAI, Google, and Anthropic remain vulnerable after applying their best defenses.

The Model Context Protocol is the fastest-growing new surface. Tool poisoning attacks manipulate the description or behavior of an external tool to lure an agent into unsafe actions; because the model reads the full tool metadata rather than just the friendly name, a poisoned description can silently redirect legitimate tools toward data deletion, security-check bypass, or chained malicious calls. Today's nginx-ui flaw (CVE-2026-33032) is the concrete proof. The NSA published MCP security design guidance in June 2026, and the KrypteiaSec glossary on MCP security tracks the defensive controls. Practical mitigations: pin and hash tool definitions, deny local execution of untrusted MCP servers, log every tool invocation with its full metadata, and apply behavioral anomaly detection on the agent's decision path.

The final AI development is offensive tooling. Kaspersky's analysis of the Armored Likho group found evidence that its first-stage loader was generated by a large language model, identified through verbose inline comments, bullet-point emoji, and redundant code blocks consistent with LLM output. A separate report describes a new APT hitting power grids in three countries with AI-crafted malware. The takeaway for defenders is that LLM-assisted malware development is no longer speculative: it lowers the skill floor for producing novel, per-target loaders that evade signature matching.

AI threat Metric or identifier Source
Prompt injection rank OWASP LLM01, 50 to 84 percent success Kunal Ganglani
Prompt injection prevalence 73 percent of production deployments Kunal Ganglani
Agentic readiness gap 83 percent deploying, 29 percent ready Cisco State of AI 2026
AI agent incident rate 88 percent of orgs affected Enterprise survey 2026
Copilot / Cursor CVEs CVSS 9.3 / 9.6 / 9.8 Cycode
MCP tool poisoning CVE-2026-33032, CVSS 9.8 Practical DevSecOps
LLM-generated malware Armored Likho BusySnake loader Kaspersky via Intel 471

Threat Actor Activity

UAT-8616 is the actor to watch this week. Cisco Talos clusters the active exploitation of CVE-2026-20182 under this identifier and assesses it as highly sophisticated. The tradecraft, exploiting a peer-authentication logic flaw discovered through source analysis rather than mass scanning, indicates a resourced operator prioritizing management-plane access to network infrastructure.

Silver Fox APT focused on Taiwan, employing spear-phishing and remote access trojans including Gh0stCringe and HoldingHands to infiltrate government and technology networks with the goal of stealing intellectual property.

Armored Likho is deploying the Python-based BusySnake Stealer against government agencies and electric power operators in Russia, Kazakhstan, and Brazil. Delivery is via spear-phishing carrying NSIS-based executable droppers or malicious .lnk shortcut files. Once resident, it steals browser passwords from Chromium and Firefox, harvests session cookies and OTP codes, collects Telegram session data, scans for cryptocurrency wallet files, and establishes reverse SSH tunnels for remote access. It is obfuscated with PyArmor Pro 9.2.0 to frustrate dynamic analysis, and its loader was, per Kaspersky, LLM-generated.

The broader operator context: Intel 471's July update reports a surge in APT campaigns targeting critical sectors, and the 2026 benchmark for adversary breakout time is now 72 minutes from initial foothold to active exfiltration, a fourfold reduction from prior-year averages. Detection windows are collapsing faster than most SOC response playbooks assume.

Source: Talos, Industrial Cyber

Ransomware and Data Breaches

The structural story of 2026 is ransomware's growth as a share of all breaches. It is now present in 44 percent of breaches, up from 32 percent the prior year, driven by Ransomware-as-a-Service lowering the barrier to entry for less-skilled actors. Average cost of a ransomware or extortion breach sits at $5.08M, and double and triple extortion, encrypting data, threatening to publish it, and directly contacting affected customers, is now standard.

Victim Actor or campaign Sector Notes
Chemco (Calgary) Qilin Manufacturing Ransomware attack confirmed
Ford Motor Company Krybit Automotive Listed on breach forum, scope under investigation
86,644 Fortinet orgs FortiBleed campaign Cross-sector, 194 countries Credential exposure, no new CVE
Multiple orgs (July 6) Various Beverages, construction, agriculture, insurance, healthcare Discovered same day

FortiBleed deserves separate emphasis because it is a hygiene failure at planetary scale, not a vulnerability. Attackers automated internet-wide scanning for FortiGate devices, tested curated password lists, and turned compromised appliances into listening posts to harvest additional credentials from passing VPN traffic. The campaign has run since at least February 2026. CISA, the UK NCSC, and Fortinet PSIRT all issued guidance within six days of the mid-June disclosure. Every organization that has ever exposed a Fortinet VPN should assume its VPN and admin credentials are in the harvested set and rotate accordingly.

Source: BlackFog, SharkStriker, Arctic Wolf

Recommended Actions

Immediate (this week)

  • Patch Cisco Catalyst SD-WAN Controller against CVE-2026-20182 and treat any exposed controller as compromised. Audit vmanage-admin authorized_keys, rotate SSH keys, and pull the management interface off the public internet.
  • Patch SharePoint against CVE-2026-45659 if not already remediated by the July 4 KEV deadline. Review for anomalous code execution by low-privilege Site Members.
  • Force-update Chrome and all Chromium browsers against the CVE-2026-11645 V8 zero-day.
  • Rotate every Fortinet VPN and admin credential exposed to the internet during the FortiBleed window (February 2026 to present) and enforce MFA on all VPN and management access.
  • Apply Citrix NetScaler fixes for CVE-2026-3055 and review SAML assertion logs.

Short-Term (this month)

  • Inventory embedded OpenSSL and patch CVE-2026-45447 across appliances, containers, and runtimes, not just OS packages.
  • Audit every MCP server for unauthenticated tool-invocation endpoints in the pattern of CVE-2026-33032. Pin and hash tool definitions, deny local execution of untrusted servers, and log full tool metadata on every call.
  • Deploy prompt-injection controls on all production LLM and agent systems: input and output filtering, least-privilege tool scoping, and human approval gates on high-impact tool actions.
  • Tune detection for 72-minute breakout. Validate that your SOC can contain a foothold before lateral movement, not after.

Strategic (this quarter)

  • Reclassify management-plane appliances as crown-jewel assets. SD-WAN controllers, VPN concentrators, and identity providers are now primary targets, not supporting infrastructure. Segment, monitor, and pen-test them accordingly.
  • Stand up an agentic red team capability. With 88 percent of organizations reporting AI agent incidents and no complete fix for prompt injection, continuous adversarial testing of agent tool-chains is the only durable control. See agentic red teaming.
  • Assume LLM-assisted malware in your threat model. Signature-based detection degrades further as per-target loaders become cheap to generate. Prioritize behavioral and anomaly-based detection.
  • Close the readiness gap before deploying agentic AI. Do not join the 83 percent deploying without joining the 29 percent who are ready. Gate agentic rollout on a documented security review.

Sources

ΛKrypteia Sec ResearchJuly 7, 2026