Daily Threat Intelligence Brief - July 27, 2026

The Operator's Take

Look at what got exploited this month and stop sorting it into "AI" and "not AI." A SonicWall appliance with a missing authorization check on an internal service, a SharePoint server with missing authentication on a critical function, an Oracle Payments endpoint that calls an internal Java function without checking who is asking, and a Langflow AI builder that runs another user's flow because it never confirmed ownership are the same vulnerability wearing four different logos. Every one is a privileged component sitting at a trust boundary that forgot to ask "are you allowed to do this." The GitLost disclosure is the punchline: GitHub's own AI agent leaked a private repository because someone wrote the word "additionally" in a public issue, which is authorization failure by social engineering rather than by code. The lesson for this week is uncomfortable but simple. Your AI agent frameworks are internet-facing appliances now, and they deserve the same exposure inventory, patch cadence, and least-privilege scoping you already apply to a VPN concentrator. If you cannot name every Langflow, GitHub Agentic Workflow, and MCP server in your estate by Friday, that is the gap an opportunistic actor monetized in June while you were still calling it a science project. Treat authorization on agent tool-calls as the new perimeter, because attackers already do.

Executive Summary

SonicWall SMA1000 zero-days chained in the wild. CVE-2026-15409 (CVSS 10.0 unauthenticated SSRF) and CVE-2026-15410 (command injection) were discovered by Rapid7 being exploited to push custom malware and reach root. Both are now in CISA KEV.
Microsoft shipped its largest Patch Tuesday ever. July fixed 570-plus CVEs including two actively exploited zero-days: SharePoint CVE-2026-56164 and AD FS CVE-2026-56155.
Langflow AI builder exploited for financial gain. CVE-2026-55255 (CVSS 9.9 authorization bypass) is under active attack for botnet enrollment, cryptomining, and AWS credential theft, per Sysdig. CISA set a July 10 federal patch deadline.
Oracle E-Business Suite takeover flaw exploited before any public PoC. CVE-2026-46817 (CVSS 9.8) in Oracle Payments was added to KEV on July 15 after honeypot-confirmed exploitation.
GitHub Agentic Workflows leak private repos via prompt injection. Noma Labs' GitLost technique exfiltrates private repository contents through a single public issue comment.
Adobe Experience Manager RCE added to KEV. CVE-2025-54253 (CVSS 10.0 auth-bypass to RCE via Struts2 devmode) is under active exploitation.
Anubis ransomware halted Coca-Cola Fairlife production. Coca-Cola disclosed the incident in a July 16 Form 8-K; Anubis claims 1TB exfiltrated with a July 27 deadline.
Conduent breach ballooned past 62 million individuals, with SSNs and medical data exposed, per ongoing healthcare breach reporting.

Critical Vulnerabilities

CVE-2026-15409 and CVE-2026-15410: SonicWall SMA1000 Zero-Days

Rapid7's MDR team discovered two zero-days under active exploitation in SonicWall SMA1000 remote-access appliances. CVE-2026-15409 is a critical unauthenticated server-side request forgery flaw carrying a CVSS score of 10.0, letting an attacker open a websocket-based tunnel to arbitrary localhost-only services. CVE-2026-15410 (CVSS 7.2) is a command injection weakness in the Appliance Management Console that permits code execution as root through a malicious path-traversal remove_hotfix workflow against the internal service on port 8188.

Chained together, an unauthenticated attacker reaches an internal-only service and then executes operating-system commands as root. SonicWall confirmed exploitation in the wild and reported attackers deploying custom malware. Affected products are the SMA1000 6210, 7210, and 8200v. Patches are available in versions 12.4.3-03453 and 12.5.0-02835. Both CVEs are in CISA KEV.

Field	Detail
CVEs	CVE-2026-15409, CVE-2026-15410
CVSS	10.0 (SSRF), 7.2 (command injection)
Product	SonicWall SMA1000 6210, 7210, 8200v
Status	Actively exploited, in CISA KEV
Fix	12.4.3-03453, 12.5.0-02835

CVE-2026-56164: Microsoft SharePoint Server Zero-Day

CVE-2026-56164 is a missing-authentication vulnerability in on-premises SharePoint Server 2016, 2019, and Subscription Edition that lets an unauthenticated attacker escalate privileges over the network with no user interaction. Microsoft assigned CVSS 5.3, but the National Vulnerability Database independently scored it 9.8 Critical, a gap defenders should not let the lower vendor number obscure.

It was discovered by Mandiant incident responders and Google's FLARE team inside active attacks, where adversaries chained it with earlier SharePoint weaknesses to steal IIS machine keys, establish persistence, and deploy malware. Fixed in the July Patch Tuesday; CISA set a July 17 federal remediation deadline.

CVE-2026-56155: Active Directory Federation Services Zero-Day

CVE-2026-56155 is an actively exploited elevation-of-privilege flaw in AD FS caused by insufficient granularity of access control. A compromised low-privilege account can climb to administrator rights inside an organization's identity infrastructure. Because AD FS brokers federated authentication, a successful escalation here undermines trust in every downstream application relying on it. It was added to CISA KEV on July 14 and patched the same week.

CVE-2026-55255: Langflow Authorization Bypass

CVE-2026-55255 is an Insecure Direct Object Reference vulnerability in the Langflow AI application builder, residing in the /api/v1/responses endpoint and affecting all versions before 1.9.2. The endpoint resolves a flow object directly from a supplied identifier without confirming the caller owns it or holds execution rights, so an authenticated attacker can execute other users' flows.

The Sysdig Threat Research Team documented exploitation starting June 25, observing a multi-stage loader that injects a custom Langflow component to shell out and pull a second-stage implant. Activity is consistent with botnet enrollment, cryptomining, and harvesting of cloud credentials including AWS keys and database secrets. Rated CVSS 9.9. CISA ordered federal agencies to patch by July 10.

CVE-2026-46817: Oracle E-Business Suite Takeover

CVE-2026-46817 (CVSS 9.8) is an improper-privilege-management and authentication flaw in the File Transmission component of Oracle Payments that enables unauthenticated takeover of susceptible instances. The exploit targets the ibytransmit endpoint and calls an internal Oracle Java function directly to read files from the server.

First in-the-wild exploitation was recorded June 27, 2026 on Oracle E-Business honeypots, roughly six weeks after Oracle's May patch and before any public proof-of-concept existed. Affected versions run from 12.2.3 through 12.2.15. Added to CISA KEV on July 15.

CVE-2025-54253: Adobe Experience Manager RCE

CVE-2025-54253 is a CVSS 10.0 misconfiguration in Adobe Experience Manager that chains an authentication bypass to remote code execution via Struts2 devmode, granting full control of the affected system. CISA added it to KEV in the July 7 batch. In parallel, Adobe's July release patched 88 unique CVEs across 12 bulletins, and the ColdFusion path-traversal flaw CVE-2026-48282 came under active exploitation within hours of disclosure.

CVE-2026-50661: Windows BitLocker (Disclosed, Not Yet Exploited)

A third Microsoft zero-day, CVE-2026-50661 in Windows BitLocker, was publicly disclosed with no confirmed in-the-wild exploitation. It requires physical access to bypass full-disk encryption and reach data. Lower urgency than the two exploited zero-days above, but material for high-value-endpoint and travel-laptop threat models.

AI Security Threats

The through-line of this month is that AI agent surfaces are being exploited with the same techniques defenders spent a decade learning to stop on classic infrastructure. Missing authorization, missing authentication, and untrusted-input-to-privileged-action are back, this time inside the agent runtime.

GitLost: Prompt Injection Against GitHub Agentic Workflows

Noma Labs disclosed GitLost on July 6, 2026, a prompt-injection technique that makes GitHub Agentic Workflows leak private repository contents through a public issue comment. GitHub Agentic Workflows, first released in February 2026, combine GitHub Actions automation with an AI agent such as Copilot or Anthropic's Claude, configured with permissions to read repositories and call tools.

An unauthenticated attacker only had to file a plausible issue in a public repository while the workflow's agent held broader read access. Noma's proof-of-concept requested the README.md from both a public and a private repo in the same organization. Researchers found that placing the word "additionally" before the private-file request slipped past guardrails and caused the agent to divulge private contents via the add-comment tool. The Hacker News and The Register frame this as an architectural agent-risk pattern rather than a patchable bug: untrusted text plus private-data access plus a public output channel equals an exfiltration path. This is the prompt injection lethal-trifecta made concrete.

Prompt Injection Remains the Number One AI Threat

Industry telemetry continues to rank prompt injection as the defining AI security crisis of 2026, with reporting of a sharp year-over-year rise in attacks. OWASP data cited by Help Net Security shows prompt injection still drives most agentic AI security failures reaching production. The working defenses are containment patterns: least privilege on agent tools, human approval for risky actions, and sandboxed execution. See agentic red teaming for how to test these controls before an adversary does.

When Prompts Become Shells

Microsoft researchers demonstrated a path in Semantic Kernel where prompt injection escalates to host-level remote code execution, with a single prompt launching calc.exe on the device running the AI agent. Combined with the Langflow exploitation above, the message is that agent frameworks with tool-execution capability are code-execution surfaces and must be treated as such.

AI Supply Chain Exposure

A backdoor sat on PyPI for roughly three hours in March 2026 and was pulled down nearly 47,000 times, compromising LiteLLM, the language-model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other frameworks. A gateway component sitting between agents and models is a high-leverage target, and MCP security discipline should extend to every dependency in the agent stack.

AI Threat	Vector	Impact	Source
GitLost	Indirect prompt injection via public issue	Private repo exfiltration	Noma
Langflow CVE-2026-55255	Authorization bypass	Botnet, cryptomining, AWS key theft	Sysdig via Help Net
Semantic Kernel RCE	Prompt-to-shell	Host code execution	Microsoft
LiteLLM backdoor	PyPI supply chain	47,000 downloads across frameworks	Cyberdesserts

Threat Actor Activity

Nation-state operators continued to compress dwell time and blur attribution in 2026. Reporting summarized by Hive Security notes that Russia, China, North Korea, and Iran have each expanded operational tempo, with mean time from initial access to exfiltration reported as low as 72 minutes in the fastest campaigns.

China (Salt Typhoon). Continued fallout from the compromise of US telecommunications lawful-intercept systems, one of the most significant espionage operations disclosed to date, per Hive Security's APT guide.
North Korea. Attributed to the February 2026 theft of $1.5 billion in cryptocurrency in a single operation via a compromised software update and an infected laptop.
Iran. An Iran-linked APT posed as a Chaos ransomware member to blur attribution in an espionage campaign, echoing earlier Qilin RaaS activity against an Israeli target.

The operational pattern that matters for defenders: state actors are increasingly renting or mimicking ransomware-as-a-service tooling to disguise espionage as opportunistic crime, which means attribution based on tooling alone is now unreliable.

Ransomware and Data Breaches

Anubis Halts Coca-Cola Fairlife Production

Coca-Cola disclosed in a July 16 Form 8-K that its dairy subsidiary fairlife identified unauthorized third-party access to production-related systems in a ransomware event, temporarily suspending US production while confirming product safety was not impacted. The Anubis ransomware group claimed responsibility, saying it encrypted Fairlife's Nutanix systems and exfiltrated 1TB of data, with a leak deadline set for the morning of July 27. Anubis is a financially motivated ransomware-as-a-service operation that surfaced in late 2024 with code resembling the earlier Sphinx malware.

Conduent Breach Surpasses 62 Million

The Conduent breach expanded sharply, with healthcare breach reporting placing the affected population above 62.2 million individuals, exposing Social Security numbers, medical information, and health insurance data.

Additional Incidents

Nintendo of America confirmed employee data exposure through third-party service TinyPulse, with a $2 million ransom demand.
Nidec disclosed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology.
DHS confirmed an active intrusion into its Homeland Security Information Network after initially dismissing alerts as false positives.

Victim	Actor / Cause	Impact	Source
Coca-Cola Fairlife	Anubis ransomware	1TB claimed, US production halted	BleepingComputer
Conduent	Breach (expanding)	62.2M+ individuals, SSN and medical	Breachsense
Nintendo of America	TinyPulse third-party breach	Employee data, $2M demand	SWK
Nidec (Taiwan sub)	Ransomware	Subsidiary network	CM-Alliance
DHS HSIN	Network intrusion	Confirmed active breach	SWK

Recommended Actions

Immediate (0 to 72 hours)

Patch SonicWall SMA1000 to 12.4.3-03453 or 12.5.0-02835 now. These are chained zero-days reaching root with an unauthenticated entry point rated CVSS 10.0. Review appliance logs for unexpected websocket tunnels and remove_hotfix activity. Reference.
Apply Microsoft July Patch Tuesday with priority on SharePoint CVE-2026-56164 and AD FS CVE-2026-56155. Both are exploited. For SharePoint, rotate IIS machine keys and hunt for persistence, since machine-key theft survives patching.
Patch Langflow to 1.9.2 or later and pull any exposed instance off the public internet. Assume credential compromise if it was reachable; rotate AWS keys and database secrets.
Patch Oracle E-Business Suite (versions 12.2.3 through 12.2.15) for CVE-2026-46817 and inspect the ibytransmit endpoint for abuse. Reference.
Patch Adobe Experience Manager for CVE-2025-54253 and disable Struts2 devmode. Reference.

Short-Term (1 to 4 weeks)

Inventory every AI agent surface in the estate: Langflow, GitHub Agentic Workflows, MCP servers, Semantic Kernel deployments, and any LiteLLM gateway. Treat each as internet-facing infrastructure with a named owner and patch cadence.
Scope agent permissions to least privilege. For GitHub Agentic Workflows, restrict agent read access so a public-repo workflow cannot reach private repos, which is the GitLost precondition.
Add human approval gates for agent tool-calls that read sensitive data or write to public channels, breaking the untrusted-input-to-public-output chain.
Audit AI dependency supply chain for gateway components like LiteLLM and pin known-good versions.
Review remote-access appliance exposure broadly; SMA1000 is one of a recurring pattern of edge-device zero-days.

Strategic (1 quarter and beyond)

Fold AI agent frameworks into your vulnerability-management program rather than governing them separately. The exploited flaws this month were classic authorization and authentication failures inside AI plumbing.
Update your attribution assumptions. With state actors mimicking RaaS operations, do not treat ransomware tooling as proof of a criminal rather than an espionage motive.
Instrument for the lethal trifecta. Detect and alert wherever an agent simultaneously has untrusted input, privileged data access, and an outbound channel. Build agentic red teaming into your release process for agent-enabled products.
Prepare identity-infrastructure incident response. The AD FS and SharePoint machine-key thefts show that patching alone does not evict an actor who already extracted signing material.