Daily Threat Intelligence Brief - July 25, 2026

The Operator's Take

The through-line today is not any single CVE, it is the collapsing gap between disclosure and mass exploitation, and who is closing it. Citrix NetScaler CVE-2026-8451 went from patch to in-the-wild abuse in under 24 hours, and Microsoft's own SharePoint zero-day landed on the KEV catalog the same day the fix shipped. Speed like that is no longer a human tempo. Sysdig's writeup of JadePuffer, which it calls the first ransomware operation run end to end by an AI agent chaining a Langflow flaw into credential theft and encryption, is the tell: the same agentic tooling every enterprise is racing to deploy is now the exploitation engine on the other side. That reframes this week's SharePoint and AD FS bugs. They are not just a patch backlog, they are pre-positioned key material problems, because the documented post-exploitation goal is extracting IIS machine keys and DKM ACLs for durable, token-forging persistence that survives the patch. The defender move this week is not "patch faster," it is "assume the machine keys already walked": patch the ToolShell chain, then rotate SharePoint MachineKey and AD FS DKM secrets and hunt for forged tokens, and put the same agentic-AI stack you are shipping to production behind an assumption that its own tool surface is now an attack surface.

Executive Summary

Microsoft shipped its largest Patch Tuesday on record on July 14, with reporting ranging from 570 to 622 CVEs and three zero-days, two under active exploitation. BleepingComputer TechTimes
A second SharePoint "ToolShell" attack chain (CVE-2026-56164, CVE-2026-58644, CVE-2026-45659, plus CVE-2026-32201) is being exploited against on-premises SharePoint to steal IIS machine keys and establish deserialization persistence. Tenable
CVE-2026-56164 was added to CISA KEV on July 14, the same day it was patched, with a Federal Civilian Executive Branch remediation deadline of July 17. Tenable
An AD FS elevation-of-privilege zero-day, CVE-2026-56155, touching the Distributed Key Manager container ACL, gives attackers a token-forgery-adjacent primitive after initial access. SOC Prime
Citrix NetScaler CVE-2026-8451, a CitrixBleed-class pre-auth memory disclosure via SAML IdP, was exploited less than 24 hours after its June 30 disclosure. SecurityWeek
CISA added CVSS 10.0 flaws in Adobe ColdFusion (CVE-2026-48282) and JoomShaper/Joomla SP Page Builder (CVE-2026-56290, CVE-2026-48908) to KEV, all enabling remote code execution. The Hacker News
Sysdig documented JadePuffer, described as the first ransomware attack run end to end by an AI agent, chaining Langflow CVE-2026-33017 (EPSS 98.41%, on KEV since March) into credential theft and encryption. SecurityWeek
The Anubis ransomware group listed Coca-Cola dairy subsidiary Fairlife on July 20, days after Coca-Cola disclosed the breach in a July 16 SEC Form 8-K and suspended some US operations. CM-Alliance
Conduent breach reporting expanded to more than 62.2 million affected individuals by July 2026. BreachSense
OWASP data shows prompt injection remains the top production failure mode for agentic AI, with attack success rates cited at 50 to 84 percent and a 340 percent year-over-year surge. Help Net Security EC-Council

Critical Vulnerabilities

CVE-2026-56164: SharePoint Server Missing Authentication (Zero-Day)

A missing-authentication flaw (CWE-306) in on-premises SharePoint Server 2016, 2019, and Subscription Edition that lets an unauthenticated attacker escalate privileges over the network. Microsoft's Security Response Center identified it as exploited in the wild. CISA reports attackers are combining CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 to breach on-premises SharePoint, then extracting IIS machine keys, using deserialization to persist, and deploying malware. Patched July 14; added to CISA KEV the same day with an FCEB deadline of July 17. Patch immediately and treat MachineKey material as compromised. Tenable Windows Forum

CVE-2026-58644: SharePoint Unauthenticated Deserialization RCE

An unauthenticated deserialization vulnerability in SharePoint Server carrying CVSS 9.8, part of the second ToolShell chain. Combined with the missing-auth EoP above, it yields unauthenticated remote code execution against internet-facing SharePoint. SideHustleBuilds SOC Prime

CVE-2026-45659: SharePoint RCE via Untrusted Deserialization

A SharePoint Server remote code execution vulnerability (CVSS 8.8) arising from deserialization of untrusted data, added to CISA KEV after confirmed active exploitation. It is a component of the ToolShell entry chain rather than a standalone bug. The Hacker News Tenable

CVE-2026-56155: AD FS Elevation of Privilege (Zero-Day)

An Active Directory Federation Services elevation-of-privilege flaw caused by insufficient granularity of access control on the Distributed Key Manager container ACL. It starts from local low privilege, so it is most valuable to an attacker who already holds a foothold, and its proximity to token-forgery primitives makes it a federation-trust risk. Exploited in the wild and patched July 14. SOC Prime HowToFix

CVE-2026-50661: Windows BitLocker (Publicly Disclosed)

The third zero-day in the July cycle, a Windows BitLocker flaw that was publicly disclosed but has no confirmed in-the-wild exploitation. Prioritize below the two actively exploited zero-days but do not defer indefinitely. gHacks BleepingComputer

CVE-2026-8451: Citrix NetScaler ADC and Gateway "CitrixBleed" Successor

A pre-authentication out-of-bounds read in NetScaler appliances configured as a SAML identity provider, leaking fragments of appliance memory to an unauthenticated remote attacker. It sits in the same memory-disclosure class as the original CitrixBleed and can surrender session tokens and credentials. Disclosed June 30 with patches; exploitation began in under 24 hours after watchTowr published technical detail. Internet-facing NetScaler is a top-tier initial-access target. SecurityWeek Beazley Security

CVE-2026-48282: Adobe ColdFusion Path Traversal to Code Execution

A CVSS 10.0 path traversal in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user. Added to CISA KEV after confirmed exploitation. The Hacker News

CVE-2026-56290 and CVE-2026-48908: Joomla / SP Page Builder Unauthenticated Upload RCE

Two CVSS 10.0 flaws in JoomShaper SP Page Builder allowing unauthenticated arbitrary file upload, which yields remote code execution on affected Joomla sites. Both were added to CISA KEV in the July 6 to 12 window. The Hacker News SecurityOnline

CVE-2026-33017: Langflow Remote Code Execution

A remote code execution flaw in the Langflow AI-agent framework carrying a 98.41 percent EPSS score, on CISA KEV since March 2026. It is now the entry point for AI-driven ransomware (see AI Security Threats). Any exposed Langflow instance should be considered a live target. SecurityWeek

CVE	Product	Class	CVSS	Status
CVE-2026-56164	SharePoint Server	Missing auth / EoP	High	Exploited, KEV, patched Jul 14
CVE-2026-58644	SharePoint Server	Deserialization RCE	9.8	Exploited, patched Jul 14
CVE-2026-45659	SharePoint Server	Deserialization RCE	8.8	Exploited, KEV
CVE-2026-56155	AD FS	EoP (DKM ACL)	High	Exploited, patched Jul 14
CVE-2026-50661	Windows BitLocker	Security bypass	Medium	Public, no ITW
CVE-2026-8451	Citrix NetScaler	Pre-auth memory read	High	Exploited < 24h
CVE-2026-48282	Adobe ColdFusion	Path traversal to ACE	10.0	Exploited, KEV
CVE-2026-56290	Joomla SP Page Builder	Unauth upload RCE	10.0	Exploited, KEV
CVE-2026-48908	Joomla SP Page Builder	Unauth upload RCE	10.0	Exploited, KEV
CVE-2026-33017	Langflow	RCE	Critical	Exploited, KEV since Mar

AI Security Threats

The most consequential AI-security development this cycle is operational, not theoretical. Sysdig documented an operation it calls JadePuffer as, in its assessment, the first ransomware attack run end to end by an AI agent. The chain begins at Langflow CVE-2026-33017, an RCE in a widely deployed AI-agent framework, and proceeds through credential theft to file encryption at machine speed with minimal human direction. This is the convergence defenders have been warned about: a classic exposed-service RCE feeding an autonomous offensive agent that compresses the intrusion lifecycle from days to minutes. SecurityWeek

The defensive posture remains badly behind the deployment curve. Cisco's State of AI Security 2026 reports that 83 percent of organizations plan to deploy agentic AI while only 29 percent feel ready to do so securely. OWASP continues to rank prompt injection as LLM01, the top risk, and industry reporting places its attack success rate between 50 and 84 percent depending on configuration and attempt count, with a cited 340 percent year-over-year surge in prompt-injection activity. No frontier vendor, Anthropic, OpenAI, or Google included, has a complete fix, so defense in depth is the only viable strategy. See the prompt injection and agentic red teaming references. Help Net Security EC-Council

The attack surface now spans well past the chat box. Agentic workflows, RAG pipelines, multimodal models, and AI coding assistants each open distinct injection vectors that text-only filters cannot cover. The rise of the Model Context Protocol has expanded that surface further, introducing tool poisoning and credential theft through malicious or compromised tool definitions, which is why MCP security belongs on the same review board as network segmentation. Real production exploitation is already documented: critical CVEs in Microsoft Copilot (CVSS 9.3), GitHub Copilot (CVSS 9.6), and Cursor IDE (CVSS 9.8) show the coding-assistant tier is a live target, not a lab curiosity. Vectra AI AI Magicx

The AI supply chain is the other soft underbelly. Reporting notes that a backdoored build of LiteLLM, the language-model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other frameworks, sat on PyPI for roughly three hours in March 2026 and was pulled down nearly 47,000 times in that window. A three-hour compromise of a single gateway package rippling into tens of thousands of downstream agent stacks is the AI-era equivalent of a poisoned dependency, and it argues for pinning, hash verification, and provenance checks on every model-gateway and agent-framework dependency. AI Magicx

Threat Actor Activity

Anubis ransomware group. Listed Coca-Cola dairy subsidiary Fairlife on its leak site on July 20, days after Coca-Cola confirmed in a July 16 SEC Form 8-K that attackers reached parts of Fairlife's production environment, prompting a temporary suspension of some US operations. The tight gap between SEC disclosure and public extortion listing reflects the double-extortion tempo now standard for this group. CM-Alliance
JadePuffer (AI-agent operator). Credited by Sysdig with the first end-to-end AI-agent-run ransomware campaign, chaining Langflow CVE-2026-33017 into credential theft and encryption. Signals a shift from AI-assisted to AI-autonomous intrusion. SecurityWeek
SharePoint ToolShell operators. Actors chaining CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 against on-premises SharePoint, with a post-exploitation focus on extracting IIS machine keys and planting deserialization-based persistence, a playbook designed to survive patching. Tenable
NetScaler exploitation crews. Began abusing CVE-2026-8451 within 24 hours of disclosure, targeting internet-facing NetScaler SAML IdP deployments for memory disclosure and session hijacking, mirroring the original CitrixBleed campaigns. SecurityWeek

Ransomware and Data Breaches

Victim / Target	Actor or Vector	Impact	Source
Coca-Cola / Fairlife	Anubis ransomware	Production environment accessed, US ops temporarily suspended, leak-site listing Jul 20	CM-Alliance
Conduent	Data breach (expanded reporting)	More than 62.2 million individuals affected	BreachSense
Nintendo of America	Breach of third party TinyPulse	Employee data exposed, $2 million ransom demand	BreachSense
DHS (HSIN)	Active network intrusion	Confirmed Jul 1 after two alerts dismissed as false positives	CM-Alliance
Multiple (JadePuffer)	AI-agent ransomware via Langflow RCE	End-to-end automated credential theft and encryption	SecurityWeek

The Conduent figure is a reminder that third-party and business-process outsourcers remain single points of failure for tens of millions of records at a time, and the Nintendo and DHS entries show the same third-party exposure pattern reaching both consumer brands and government networks. BreachSense CM-Alliance

Recommended Actions

Immediate (0 to 72 hours)

Patch the SharePoint ToolShell chain (CVE-2026-56164, CVE-2026-58644, CVE-2026-45659, CVE-2026-32201) on all on-premises SharePoint 2016, 2019, and Subscription Edition instances now. Tenable
Assume machine-key compromise on any SharePoint that was internet-facing before patching: rotate the ASP.NET MachineKey, restart IIS, and hunt for forged tokens and web shells, because patching alone does not evict a key-theft persistence foothold. Tenable
Patch AD FS for CVE-2026-56155 and audit the Distributed Key Manager container ACL and DKM key material for signs of tampering or token forgery. SOC Prime
Patch Citrix NetScaler ADC and Gateway for CVE-2026-8451, terminate and rotate active sessions, and invalidate credentials that may have transited a SAML IdP appliance. Beazley Security
Apply the July Patch Tuesday rollup, prioritizing the two exploited zero-days over the remaining critical RCEs. BleepingComputer
Patch or isolate exposed Adobe ColdFusion (CVE-2026-48282), Joomla SP Page Builder (CVE-2026-56290, CVE-2026-48908), and Langflow (CVE-2026-33017) against the FCEB KEV deadlines. The Hacker News

Short-Term (1 to 4 weeks)

Inventory every internet-facing Langflow and AI-agent-framework instance and take unauthenticated ones offline or behind authentication, given the JadePuffer precedent. SecurityWeek
Pin and hash-verify AI supply-chain dependencies, especially model gateways like LiteLLM, and enable provenance checks in CI to catch a repeat of the PyPI backdoor. AI Magicx
Add prompt-injection and tool-poisoning test cases to any agentic or RAG deployment, and constrain agent tool permissions to least privilege. See MCP security. Help Net Security
Reduce federation blast radius: monitor AD FS token issuance for anomalies and shorten token lifetimes where feasible. SOC Prime

Strategic (1 quarter and beyond)

Close the agentic-AI readiness gap: treat every AI agent you deploy as both a target and a potential attacker, and stand up agentic red teaming as a standing program rather than a one-off review. Vectra AI
Re-architect on-premises identity and collaboration servers on the assumption that key material will be stolen, favoring short-lived credentials, automated key rotation, and hardware-backed secrets over static machine keys. Tenable
Reduce dependence on single third-party processors for large record populations, informed by the 62.2 million-person Conduent exposure. BreachSense
Build detection for machine-speed intrusion chains, since AI-agent-driven operations like JadePuffer defeat human-tempo response playbooks. SecurityWeek