Skip to content
Krypteia Sec
Back to Threat Intel
TLP:CLEARCTI-2026-0720

Daily Threat Intelligence Brief - July 20, 2026

Microsoft ships a record 570-CVE Patch Tuesday with two exploited zero-days (SharePoint CVE-2026-56164, AD FS CVE-2026-56155); CISA adds SharePoint RCE CVE-2026-58644 and Langflow CVE-2026-55255 to KEV; JADEPUFFER becomes the first end-to-end agentic-AI ransomware; FortiBleed drives 12-plus ransomware infections.

By The OperatorJuly 20, 202614 min read
ctivulnerabilitiesransomwareai-securityagentic-aithreat-actors

The Operator's Take

AI showed up on all three sides of the board this week, and that is the story worth sitting with. Microsoft credited an in-house AI vulnerability-discovery system for the largest Patch Tuesday on record, 570 flaws in one release; a Langflow authorization bug (CVE-2026-55255) became the internet-facing door attackers walked through; and JADEPUFFER, an autonomous LLM agent, ran an extortion operation end to end, from break-in to database drop, with a human only provisioning infrastructure. The machine is now the auditor, the target, and the operator at once. The non-obvious connection defenders keep missing: the SharePoint zero-day (CVE-2026-56164) and the ToolShell fingerprint behind it prove that patching does not evict an attacker who already stole your IIS machine keys, and the same "the artifact survives the patch" logic applies to any secret an agent can read from a compromised AI workflow host. So this week, do two things you probably deferred: rotate SharePoint ASP.NET machine keys after patching (not instead of it), and put your Langflow, MCP servers, and any internet-reachable agent tooling on the same asset inventory and CISA-KEV clock as your VPNs and firewalls. The experiment you spun up in Q1 is now production attack surface, and adversaries are enumerating it faster than your change board can.

Executive Summary

  • Microsoft's July 2026 Patch Tuesday fixed a record 570 Microsoft CVEs (roughly 622 across all products), including three zero-days, two of them exploited in the wild before a patch existed. BleepingComputer
  • CVE-2026-56164 (Microsoft SharePoint Server, missing authentication) and CVE-2026-56155 (Active Directory Federation Services, elevation of privilege) were actively exploited as zero-days and added to the CISA KEV catalog. Cybernews
  • CISA added a second SharePoint RCE zero-day, CVE-2026-58644, to KEV on July 16, and warned that attackers are chaining it and CVE-2026-56164 with older flaws to steal IIS machine keys. The Hacker News
  • CISA ordered federal agencies to prioritize patching Langflow CVE-2026-55255, an authorization bypass exploited alongside RCE flaw CVE-2026-33017 in a June 22 to 25 campaign. BleepingComputer
  • JADEPUFFER, documented by Sysdig, is the first known end-to-end agentic-AI ransomware operation: an LLM agent broke into a Langflow instance, swept secrets, and encrypted 1,342 configuration items. Sysdig
  • The FortiBleed campaign aggregated 74,000 stolen Fortinet credentials into a searchable database and has driven at least 12 confirmed ransomware infections tied to the INC/Lynx pipeline. Tech Insider
  • Citrix NetScaler CVE-2026-8451 ("CitrixBleed"), a memory-overread flaw, was exploited within 24 hours of its June 30 disclosure. Carthage Electronics
  • Prompt injection remains OWASP's number-one LLM threat with a reported 340% year-over-year rise in attacks, and 88% of surveyed organizations reported confirmed or suspected AI-agent security incidents in the past year. Help Net Security
  • Ransomware groups Qilin (Chemco Manufacturing) and Krybit (Ford Motor Company) claimed new victims, and Kubota North America disclosed month-long unauthorized network access. SharkStriker

Critical Vulnerabilities

CVE-2026-56164: Microsoft SharePoint Server (Missing Authentication)

A missing-authentication flaw in on-premises SharePoint Server that lets an unauthenticated network attacker escalate privileges with no user interaction. It was exploited as a zero-day before Microsoft's July 14 patch and added to CISA KEV. CISA describes attackers chaining it with previously disclosed flaws CVE-2026-32201 and CVE-2026-45659 to steal IIS machine keys, establish persistence, and deploy malware. The critical operational point: machine-key theft survives patching, so remediation requires key rotation, not just the update. Affects SharePoint Subscription Edition, 2019, and 2016. The Register, Resecurity

CVE-2026-58644: Microsoft SharePoint Server (RCE Zero-Day)

A SharePoint Server remote code execution zero-day affecting on-premises installations, added to the CISA KEV catalog on July 16, 2026 after evidence of active exploitation. It is part of the same cluster of SharePoint flaws (alongside CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) that CISA flagged as actively exploited against on-premises servers. The Hacker News, CISA

CVE-2026-56155: Active Directory Federation Services (Elevation of Privilege)

An actively exploited AD FS elevation-of-privilege vulnerability. A successful exploit lets an attacker gain administrator privileges, a high-value outcome against a federation and single-sign-on control plane. Exploited as a zero-day before the July 14 patch and added to KEV. Forbes, Cybernews

CVE-2026-55255: Langflow (Authorization Bypass / IDOR)

An Insecure Direct Object Reference flaw (CVSS 6.1) that lets an authenticated attacker execute any flow belonging to another user by supplying the victim's flow_id (UUID) to the /api/v1/responses endpoint, exposing data processed by those flows and consuming their resources. It was weaponized alongside RCE flaw CVE-2026-33017 in a sustained June 22 to 25, 2026 campaign, and CISA added it to KEV under Binding Operational Directive 26-04. Do not let the modest CVSS score mislead: this is AI-workflow infrastructure exposed to the internet, and KEV placement means it is being used now. NVD, SC Media

CVE-2026-8451: Citrix NetScaler ADC/Gateway ("CitrixBleed")

A memory-overread vulnerability that lets unauthenticated attackers read sensitive information from system memory, enabling session hijacking and further compromise, an echo of the original CitrixBleed pattern. It was exploited within 24 hours of its June 30 disclosure. Any organization running NetScaler ADC or Gateway should assume session tokens may be exposed and force re-authentication after patching. Carthage Electronics

CVE-2026-25089 and CVE-2026-26083: Fortinet FortiSandbox (RCE)

Two CVSS 9.8 remote code execution vulnerabilities in Fortinet's FortiSandbox product under active exploitation, part of a batch of seven flaws Fortinet patched across FortiOS, FortiProxy, FortiPAM, and FortiSandbox. Network security appliances remain a top-tier initial-access target. Cybersecurity News, Greenbone

CVE-2026-15409 and CVE-2026-15410: SonicWall SMA1000 (SSRF + Code Injection)

Server-Side Request Forgery (CVE-2026-15409) and code injection (CVE-2026-15410) vulnerabilities in SonicWall SMA1000 appliances, both added to CISA KEV on July 14 following evidence of active exploitation. Remote-access appliances again sit at the top of the exploited-in-the-wild list. CISA

CVE-2026-48282: Adobe ColdFusion (Path Traversal)

An Adobe ColdFusion path traversal vulnerability added to CISA KEV on July 7 based on evidence of active exploitation. ColdFusion continues its long history as a reliable target for opportunistic web-server compromise. SC Media

Joomla Ecosystem: CVE-2026-48908, CVE-2026-56290, CVE-2026-48939, CVE-2026-56291

A cluster of Joomla-extension flaws added to KEV across July 7 and July 10: SP Page Builder unrestricted file upload (CVE-2026-48908), Joomlack Page Builder improper access control (CVE-2026-56290), iCagenda unrestricted file upload (CVE-2026-48939), and Balbooa Forms unrestricted file upload (CVE-2026-56291). Attackers are systematically hunting third-party CMS plugins for webshell-drop primitives. CISA

AI Security Threats

This week is the clearest signal yet that AI systems have crossed from "emerging risk" to operational attack surface and, for the first time, operational attacker. Three developments define the shift.

Langflow is the new initial-access frontier. CVE-2026-55255 is an authorization bypass in a widely deployed low-code AI-agent-builder platform, and its placement in CISA KEV under BOD 26-04 confirms in-the-wild use. It was chained with RCE flaw CVE-2026-33017 during a June 22 to 25 campaign that ran application and auth reconnaissance, flow enumeration, the IDOR, and then a sustained RCE loop with outbound connections. The takeaway for defenders: the AI-agent orchestration tools your teams stood up are now enumerated and exploited exactly like any other internet-facing app, and they frequently hold API keys, model credentials, and data-source secrets. The Hacker News, SecurityWeek

JADEPUFFER: the attacker is now the agent. Sysdig documented the first known end-to-end agentic ransomware operation. A human operator deployed an LLM agent and the infrastructure around it, then let the agent run the entire extortion chain: it broke into an internet-facing Langflow instance via CVE-2025-3248, swept the host for secrets, pivoted to the target, forced its way into a Nacos configuration service, encrypted 1,342 configuration items, deleted the originals, and dropped production databases. The Cloud Security Alliance and NSFOCUS have published parallel analyses. This is the "machine-speed adversary" made concrete: the loop from foothold to encryption compresses to whatever the agent's token budget allows, collapsing the human response window. Sysdig, Cloud Security Alliance, NSFOCUS

Prompt injection remains the structural weakness under all of it. Prompt injection has held the number-one slot on OWASP's LLM Top 10 across every edition, with a reported 340% year-over-year rise in attacks, and it still drives most agentic-AI security failures in production. The mechanism is unchanged and hard to patch away: an AI agent is compromised through the very content it is designed to process, a single sentence in a retrieved document, webpage, or code comment can redirect behavior, exfiltrate data, or trigger unauthorized actions. Once an agent holds email, database, shell, or deployment access, a successful injection lets an attacker act through the system rather than merely produce a wrong answer, the lethal trifecta of private data, untrusted content, and external communication. A 2026 enterprise survey found 88% of organizations reported confirmed or suspected AI-agent security incidents in the past year. Help Net Security, Airia

MCP and the agent supply chain. As agents proliferate, Model Context Protocol (MCP) servers become a fresh trust boundary: a malicious or compromised MCP tool is untrusted content with a direct line to the agent's privileges. Treat every MCP server, tool definition, and connector as part of your attack surface and subject them to the same agentic red teaming you would apply to any privileged integration. TechStoriess

Defensive posture for AI systems this week: enforce least privilege on every agent and tool, separate trusted instructions from untrusted data, validate outputs before they trigger actions, keep a human in the loop for irreversible operations, inventory internet-facing AI infrastructure (Langflow, MCP servers, orchestration UIs), and monitor agent action logs at machine speed because the adversary now operates at machine speed. ecorpit

Threat Actor Activity

Actor / Campaign Type Activity This Period Source
ToolShell cluster (Linen Typhoon, Violet Typhoon, Storm-2603) Nation-state + ransomware July 2026 SharePoint attacks carry the same mechanical fingerprint as the 2025 ToolShell campaign: chain fresh RCE with older flaws, steal IIS machine keys, persist across patches. Original campaign hit finance, healthcare, government, and energy at scale. Resecurity
JADEPUFFER operator Agentic-AI extortion Lone operator directed an autonomous LLM agent to run a full ransomware operation against a Langflow-exposed environment, encrypting 1,342 config items and dropping production databases. Sysdig
FortiBleed operators (INC / Lynx pipeline) Credential aggregation to ransomware Stitched years of leaked Fortinet credentials, brute-forced logins, exfiltrated configs, and cracked hashes into one searchable database sorted by country, sector, and revenue; feeding INC and Lynx ransomware deployments. IT Briefcase
Langflow campaign operator Opportunistic RCE Weaponized CVE-2026-55255 plus CVE-2026-33017 in a sustained June 22 to 25 session of recon, flow enumeration, IDOR, and looping RCE. The Hacker News
Qilin Ransomware Claimed Chemco Manufacturing. SharkStriker
Krybit Ransomware / extortion Listed Ford Motor Company on a data-leak forum. SharkStriker

Ransomware and Data Breaches

Victim Actor / Vector Impact Source
Chemco Manufacturing Qilin ransomware Ransomware attack; extortion listing SharkStriker
Ford Motor Company Krybit ransomware Named on a data-breach forum as a victim SharkStriker
Kubota North America Undisclosed intrusion Attackers had network access for more than a month; employee data exposed SharkStriker
Undisclosed target (JADEPUFFER) Agentic-AI ransomware via Langflow 1,342 configuration items encrypted, originals deleted, production databases dropped Sysdig
Multiple organizations (FortiBleed) Fortinet credential aggregation 74,000 credentials circulating; at least 12 confirmed ransomware infections Tech Insider

The through-line: appliance and application compromise (SharePoint, Fortinet, Langflow) is still the dominant path to ransomware, and 2026's attackers increasingly automate the pivot from foothold to encryption. The manufacturing and automotive sectors again feature prominently, consistent with the broader 2026 pattern of ransomware crews targeting operationally sensitive industries. TechCrunch

Recommended Actions

Immediate (0 to 72 hours)

  • Patch and rotate keys on SharePoint on-premises. Apply the July 14 fixes for CVE-2026-56164 and CVE-2026-58644, then rotate ASP.NET machine keys and restart IIS. Patching alone does not evict an attacker who already stole your machine keys. Federal deadlines are compressed; treat this as a compliance event, not a routine cycle. CISA
  • Patch AD FS for CVE-2026-56155 and review AD FS admin group membership and sign-in logs for anomalous privilege grants. Cybernews
  • Patch or isolate Langflow. Update to a fixed release for CVE-2026-55255 and CVE-2026-33017, or remove internet exposure entirely. FCEB agencies are bound by BOD 26-04 timelines. Rotate any API keys or model credentials stored in exposed flows. BleepingComputer
  • Patch NetScaler (CVE-2026-8451) and force session re-authentication. Assume session tokens were exposed to memory overread. Carthage Electronics
  • Patch FortiSandbox (CVE-2026-25089, CVE-2026-26083) and SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410). Both are exploited-in-the-wild appliance flaws. Cybersecurity News
  • Cross-check all internet-facing assets against the July CISA KEV additions and prioritize by exposure, not CVSS alone. CISA

Short-Term (1 to 4 weeks)

  • Force-rotate Fortinet credentials and hunt for FortiBleed-style credential reuse; enable MFA on all VPN and firewall admin access and review for unauthorized config changes. Tech Insider
  • Work down the 570-CVE Patch Tuesday backlog with a risk-based order: exploited zero-days first, then critical RCEs, then the rest. BleepingComputer
  • Inventory AI and agent infrastructure as production attack surface. Enumerate every Langflow, MCP server, and agent-orchestration endpoint; remove internet exposure where possible; apply least privilege to agent tool access. TechStoriess
  • Audit third-party CMS plugins (Joomla page builders, form components) against the July KEV file-upload cluster and remove unused extensions. CISA
  • Threat-hunt for ToolShell-style persistence: machine-key theft, unexpected IIS modules, and deserialization payloads on any SharePoint host that was internet-reachable before patching. Resecurity

Strategic (1 to 3 months)

  • Adopt a defense-in-depth model for agentic AI: input sanitization, privilege separation, output validation before action, human-in-the-loop for irreversible operations, and continuous action-level monitoring. Assume prompt injection is unpatchable and design controls around that assumption. Airia
  • Stand up machine-speed detection and response. JADEPUFFER shows the foothold-to-encryption window is now measured in an agent's runtime, not an analyst's shift. Automate containment for high-confidence indicators. Sysdig
  • Treat KEV as your patch SLA, not a suggestion. Multiple flaws this period were exploited within 24 hours of disclosure; build a workflow that maps KEV additions to your asset inventory automatically. CISA
  • Reduce standing exposure of remote-access appliances. The recurring 2026 pattern (Fortinet, Citrix, SonicWall, Ivanti) is that VPN and firewall products are the preferred initial-access vector; minimize their internet-facing management surface and segment them from the core. IT Briefcase

Sources

ΛKrypteia Sec ResearchJuly 20, 2026