Skip to content
Krypteia Sec
Back to Threat Intel
TLP:CLEARCTI-2026-0726

Daily Threat Intelligence Brief - July 26, 2026

Microsoft patches a record 570 CVEs with three zero-days including SharePoint CVE-2026-56164 and AD FS CVE-2026-56155, Langflow CVE-2026-55255 becomes the first AI agent framework on CISA KEV, and Kimi K3 agents claim 19 Redis zero-days in 90 minutes as the Conduent breach passes 62 million victims.

By The OperatorJuly 26, 202614 min read
ctivulnerabilitiesransomwareai-securityagentic-aithreat-actors

The Operator's Take

Look at three items that landed this month and stop treating them as separate stories. Kimi K3 agents reportedly found 19 Redis zero-days in about 90 minutes and built a working RCE in 27 minutes. Linux kernel maintainers absorbed a record 432 CVEs in two days, which the maintainers themselves attribute to AI-fueled discovery. And Langflow, an AI agent framework, became the first of its kind to land on CISA KEV after attackers used an IDOR flaw to inject "leak api keys" into hijacked flows. The pattern is not "AI is coming to security." It is here, and it has shortened the discovery-to-exploit window to something no human patch pipeline can match, while your patch cadence is still measured in Patch Tuesdays. That is the asymmetry that matters this week.

The correct defensive move is not to patch faster on the same CVSS-ranked queue. It is to stop ranking by CVSS at all for anything internet-facing. The Langflow flaw that got weaponized was a 9.9, but its lower-scored sibling CVE-2026-33017 was exploited thousands more times, because exploitability and reachability beat theoretical severity every time. Pivot your queue to exploited-first: KEV membership and real-world exploitation evidence drive the patch order, not the score. Second, and this is the uncomfortable one for anyone running an AI stack, your Langflow, LiteLLM, MCP servers, and agent gateways are internet-facing infrastructure with the same trust boundaries as a VPN appliance, not lab toys. Put real authentication in front of them, assume the model will be tricked into acting as a confused deputy, and never let an agent hold a credential it would hand to anyone who asks nicely.

Executive Summary

  • Microsoft July Patch Tuesday fixed a record 570 CVEs, including three zero-days: SharePoint EoP CVE-2026-56164 and AD FS EoP CVE-2026-56155 (both actively exploited) plus publicly disclosed BitLocker bypass CVE-2026-50661. Source
  • On-premises SharePoint is under a multi-CVE assault (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) that chains web request to domain compromise, echoing the 2025 ToolShell pattern. Source
  • Langflow CVE-2026-55255 (CVSS 9.9) became the first AI agent framework on CISA KEV, exploited since June 25 to harvest API keys via prompt-injected flows. Source
  • Kimi K3 AI agents claimed 19 Redis zero-days in roughly 90 minutes and a full RCE build in 27 minutes; Redis shipped patches, though the autonomy and count remain self-reported. Source
  • Linux kernel maintainers logged a record 432 CVEs over two days, attributed to AI-assisted bug discovery outpacing triage capacity. Source
  • The Conduent breach expanded past 62.2 million individuals, exposing SSNs, medical, and insurance data across downstream healthcare clients. Source
  • Prompt injection remains the top production AI failure mode, up 340% year over year per OWASP's 2026 reporting, with research showing 94.4% of tested LLM agents vulnerable. Source
  • Chinese state actors (Salt Typhoon, Volt Typhoon) continue mass edge-device compromise, with adversary breakout time now benchmarked at 72 minutes. Source
  • Fortinet and Citrix edge exposure persists: FortiBleed left 86,644 firewalls with crackable hashes, and Citrix NetScaler CVE-2026-8451 saw active exploitation within 24 hours of disclosure. Source

Critical Vulnerabilities

CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege (Zero-Day)

A missing-authentication flaw in on-premises SharePoint Server that lets an unauthenticated attacker elevate privileges over the network. It is one of the two actively exploited zero-days in the July Patch Tuesday set and was added to CISA KEV on July 14, 2026, with a federal remediation deadline of July 17. Resecurity documented the full chain from web request to domain compromise, including theft of IIS machine keys for persistence. This is not a standalone bug, it is a link in a ToolShell-style chain against internet-exposed SharePoint. Patch immediately and rotate machine keys on any server that was exposed. Microsoft/Tenable FAQ | Resecurity analysis

CVE-2026-45659: Microsoft SharePoint Server Remote Code Execution

A deserialization-of-untrusted-data RCE that an authenticated attacker uses to execute code on an affected SharePoint server. Added to CISA KEV on July 1, 2026, and confirmed exploited in the same campaign as CVE-2026-56164. Combined, the two give an attacker the unauthenticated entry and the code execution needed to own the box. The Hacker News | CISA

CVE-2026-56155: Active Directory Federation Services Elevation of Privilege (Zero-Day)

An insufficient-granularity access-control flaw in AD FS that allows a compromised low-privilege account to climb to administrator rights. Actively exploited and added to CISA KEV with a federal deadline of July 28, 2026. Identity infrastructure is the prize here: a foothold in AD FS is a foothold in federated authentication across the enterprise. Prioritize this alongside the SharePoint pair. BleepingComputer | CrowdStrike

CVE-2026-55255: Langflow Authorization Bypass / IDOR (CVSS 9.9)

An insecure direct object reference in Langflow's /api/v1/responses endpoint that lets an authenticated attacker execute another user's flow by supplying the victim's flow ID. Sysdig observed first exploitation on June 25, 2026, with attackers injecting prompts like "leak api keys" into hijacked flows to harvest credentials and consume victim resources. Affects Langflow versions before 1.9.1. Added to CISA KEV on July 7. A lower-scored sibling, CVE-2026-33017 (CVSS 9.3), has been exploited thousands of times, a reminder that raw score does not predict real-world abuse. Upgrade to 1.9.1 or later and put authentication in front of any exposed Langflow instance. Sysdig | Qualys

CVE-2026-8451: Citrix NetScaler ADC/Gateway Memory Overread

A memory overread in Citrix NetScaler ADC and Gateway disclosed June 30, 2026, with active exploitation confirmed within 24 hours of disclosure. The speed from disclosure to exploitation on a widely deployed edge appliance makes this a same-day patch item for anyone running NetScaler at the perimeter. Threat-Modeling.com

CVE-2026-59835 / CVE-2026-59839: Fortinet FortiSandbox and FortiOS

Fortinet disclosed seven advisories on July 14, 2026, across FortiOS, FortiProxy, FortiPAM, and FortiSandbox. None are rated critical, but CVE-2026-59835 exposes VNC without authentication on all FortiSandbox network interfaces (unauthenticated console access), and CVE-2026-59839 is a path traversal allowing an authenticated attacker with limited CLI access to delete root filesystem files. Combined with the separate FortiBleed campaign, Fortinet edge remains a high-value target. CybersecurityNews | BleepingComputer

Redis Multi-Version Memory Corruption (AI-Discovered)

Kimi K3 agents reportedly identified memory-corruption flaws across stock builds of Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, combining a stream consumer-group shared-NACK double-free with a heap overflow in the bundled RedisBloom TDigest module. Redis released updates in July 2026 confirming the underlying issues exist, though no NVD records for the July findings had appeared as of July 24, and the claimed zero-day count and agent autonomy remain self-reported by researcher Chaofan Shou. Treat this as a patch-and-verify item and watch for formal CVE assignment. The Hacker News | heise

CVE-2026-50661: Windows BitLocker Security Feature Bypass

Publicly disclosed but not yet exploited, this flaw lets an attacker with physical access bypass BitLocker encryption and read protected data. Lower urgency than the network-exploitable zero-days, but relevant for lost or stolen device threat models and any environment relying on BitLocker as the sole at-rest control. Malwarebytes

AI Security Threats

This is the section to read twice. The AI attack surface stopped being theoretical this month and started showing up on the mandatory-patch list.

AI frameworks are now first-class targets. Langflow (CVE-2026-55255) is the headline: the first AI agent framework to earn a CISA KEV entry after real exploitation. The abuse pattern is instructive. Attackers did not need a memory-corruption exploit, they needed an authorization flaw plus prompt injection. Once they could execute a victim's flow, they injected instructions telling the agent to exfiltrate its own API keys, and the agent complied because that is what agents do. This is the confused-deputy problem wearing a 2026 costume. Source

Prompt injection is the dominant production failure mode. OWASP's 2026 reporting puts prompt injection up 340% year over year, the fastest-growing attack category, and Help Net Security's coverage of the OWASP data confirms it still drives most agentic AI security failures in the field. Academic testing cited alongside it found 94.4% of state-of-the-art LLM agents vulnerable to prompt injection, 83.3% to retrieval-based backdoors, and 100% to interagent trust exploits. If you run a multi-agent system, that last number should stop you cold: trust between your own agents is not a security boundary, it is an open door. Help Net Security | VentureBeat

The AI supply chain is a live vector. A malicious build of LiteLLM sat on PyPI for three hours in March 2026 and was pulled roughly 47,000 times before removal. LiteLLM is the model-gateway layer for CrewAI, DSPy, Microsoft GraphRAG, and other agent stacks, so a three-hour window rippled across a large slice of the agentic ecosystem, and the malicious package pulled in an autonomous attack bot. The lesson: pin your AI dependencies, verify signatures, and treat the model gateway as the crown-jewel dependency it actually is. Source

MCP expands the attack surface. The rise of the Model Context Protocol and agent tooling introduces tool poisoning and credential theft as native risks. MCP security is not a solved problem; every tool you expose to an agent is a capability an attacker inherits if they can steer the model. Prompt injection has also evolved to target RAG pipelines, model routers, and long-term memory, meaning the injection can persist across sessions rather than dying with the conversation. Source

Offensive AI is compressing the exploit timeline. The Kimi K3 Redis claims and the record Linux kernel CVE surge point the same direction: AI-assisted vulnerability discovery is producing findings faster than maintainers can triage or defenders can patch. Whether or not every Kimi K3 number holds up, Redis shipped patches and the direction of travel is not in dispute. This is the strategic case for agentic red teaming on your own systems: if attackers are fuzzing your dependencies with agents, you want to find those bugs first. The Hacker News | Open Source For You

Threat Actor Activity

Chinese state-sponsored operations continue at high tempo. Salt Typhoon has reportedly compromised networks across more than 80 countries spanning telecom, transportation, and government, while Volt Typhoon maintains low-and-slow persistence inside critical infrastructure positioned for use in a future crisis. An April 23, 2026 CISA-led advisory documented a structural shift in Chinese tradecraft: away from individually procured infrastructure and toward large, continuously refreshed networks of compromised SOHO routers, IoT devices, and end-of-life edge appliances. That shift is why the Fortinet and Citrix exposure above matters beyond the individual CVEs, those appliances are the raw material for adversary infrastructure. CloudSEK | CISA

Russian APT activity prioritized military, logistics, and energy targets, blending espionage with infrastructure-focused disruption, including new wiper families deployed against Ukrainian infrastructure. Across all state actors, 2026 reporting describes over 297 documented supply-chain attacks, 200-plus breached telecom operators across six continents, and AI-generated content now woven into the majority of state phishing operations. The headline metric for defenders is speed: the 2026 benchmark for adversary breakout time, from initial foothold to active exfiltration, is 72 minutes, a fourfold reduction from prior-year averages. Your detection-and-response window is now roughly one hour. Hive Security | CybelAngel

Ransomware & Data Breaches

Organization Type Impact / Scale Threat Actor Source
Conduent Data breach (healthcare svc) 62.2M+ individuals: SSNs, medical, insurance data Not confirmed BrightDefense
Nidec Ransomware Taiwanese subsidiary Nidec Chaun Choung network hit Not confirmed Breachsense
Nintendo of America Third-party breach Employee data exposed, $2M ransom demanded Via TinyPulse Breachsense
Multiple (Jul 3) Data breach / extortion Several orgs listed on leak sites INC_RANSOM, ANUBIS Breachsense

The Conduent figure is the one to internalize. A single breach at a business-process outsourcer cascaded to 62 million-plus individuals through downstream healthcare clients, which is the third-party-risk lesson repeating itself. Your vendors' breaches become your breaches, and the reporting population keeps growing months after initial disclosure. The Nintendo case makes the same point from a different angle: the compromise was at TinyPulse, a third-party service, not at Nintendo itself. June recap for context

Recommended Actions

Immediate (This Week)

  • Patch the three Microsoft zero-days now, in KEV-deadline order: SharePoint CVE-2026-56164 and CVE-2026-45659 first, then AD FS CVE-2026-56155 by July 28. On any exposed SharePoint server, rotate IIS machine keys and hunt for webshells and stolen keys, patching alone does not evict an established foothold. Reference
  • Upgrade Langflow to 1.9.1 or later and take any internet-exposed instance offline until it sits behind authentication. Rotate every API key that a Langflow flow could have touched. Reference
  • Patch Citrix NetScaler (CVE-2026-8451) and review Fortinet advisories from July 14. Assume edge appliances are being actively targeted for recruitment into adversary infrastructure. Reference
  • Update Redis to the latest July builds and monitor for formal CVE assignment on the shared-NACK and TDigest findings. Reference

Short-Term (This Month)

  • Reorder your patch queue to exploited-first. Drive prioritization by CISA KEV membership and real-world exploitation evidence, not CVSS score. CVE-2026-33017 outpacing its higher-scored sibling is the proof. Reference
  • Inventory and authenticate your AI infrastructure. Treat Langflow, LiteLLM, MCP servers, and agent gateways as internet-facing systems with real trust boundaries. No agent should hold a credential it would disclose to any caller. Reference
  • Pin and verify AI supply-chain dependencies. After the three-hour LiteLLM PyPI incident, enforce signature verification and version pinning on model-gateway and agent-framework packages. Reference
  • Reassess third-party breach exposure. Map which vendors hold your regulated data and confirm your incident notification depends on their disclosure timelines, not just your own. Reference

Strategic (This Quarter)

  • Tune detection to a 72-minute breakout window. If your mean time to detect exceeds an hour, the adversary benchmark has already moved past you. Invest in identity-layer telemetry given the AD FS and SharePoint identity targeting. Reference
  • Stand up agentic red teaming against your own stack. If attackers are fuzzing dependencies and abusing agents with AI, adopt the same tooling defensively to find the flaws first. See agentic red teaming. Reference
  • Build a prompt-injection defense program. Given 94.4% agent vulnerability and 100% susceptibility to interagent trust exploits, treat prompt injection as a design-level threat: least-privilege tool access, output validation, and no implicit trust between agents. See prompt injection and MCP security. Reference
  • Harden edge appliance lifecycle. With Chinese actors harvesting end-of-life routers and appliances, formalize decommissioning of unsupported edge hardware before it becomes someone else's C2. Reference

Sources

ΛKrypteia Sec ResearchJuly 26, 2026