Daily Threat Intelligence Brief - July 28, 2026

The Operator's Take

The headline is ToolShell v2, and it deserves the patch cycle, but the item that should change how you think this week is quieter: Langflow's IDOR flaw (CVE-2026-55255) landed in CISA's KEV with confirmed in-the-wild exploitation aimed at code execution and second-stage implant delivery. That is the first time an AI-agent orchestration platform has been treated the same way CISA treats a SharePoint server or a Fortinet appliance: as production attack surface actively being used to breach organizations, not as a research curiosity. The AI-security conversation has spent two years on prompt injection and jailbreaks, and while that work matters, the actual initial-access event of the month was a boring authorization bug in an AI tool that shipped without an ownership check on an API endpoint. The lesson connects directly to the Linux kernel's 432-CVE weekend and Microsoft's record 622-CVE month: AI is now on both sides of the vulnerability curve at once, flooding maintainers with AI-assisted discovery while AI infrastructure itself becomes the target. The defender move this week is not a new AI firewall. It is to inventory every AI agent builder, MCP server, and LLM orchestration tool you have quietly stood up in the last year and put it under the same asset management, patch SLA, and network-exposure rules you already apply to your web servers. If it can execute a flow, call a tool, or reach a credential, it is production, and attackers are now treating it that way.

Executive Summary

Microsoft shipped its largest Patch Tuesday ever, 622 CVEs, with three zero-days and two under active exploitation before patches were available. BleepingComputer Orca Security
A second on-prem SharePoint mass-exploitation event, dubbed ToolShell v2, chains CVE-2026-56164 (missing-auth EoP) and CVE-2026-58644 (unauthenticated deserialization RCE, CVSS 9.8). SocPrime The Hacker News
CVE-2026-56155, an AD FS elevation-of-privilege zero-day, carried a federal patch deadline of today, July 28, 2026. AD FS brokers federated authentication, so escalation here undermines trust in every downstream application relying on it. Tenable
Langflow's CVE-2026-55255 (CVSS 9.9) became the first AI-agent orchestration platform added to CISA KEV, with exploitation observed since June 25 targeting code execution and implant delivery. BleepingComputer Qualys
CISA added Fortinet FortiOS SSL-VPN (CVE-2025-68686) and Arista VeloCloud Orchestrator (CVE-2026-16812) to KEV on July 27, both edge-appliance flaws. CISA
Anubis ransomware halted production at Coca-Cola subsidiary Fairlife, a brand with roughly $4 billion in annual sales, and threatened to leak 1TB of data. BleepingComputer SecurityWeek
A 25-year-old flaw in libcurl (CVE-2026-8932) enables mTLS connection-reuse authentication bypass across applications built on the library. SecurityWeek
Linux kernel maintainers absorbed a record 432 CVEs disclosed across a single weekend, reigniting the debate over AI-assisted vulnerability discovery and patch prioritization. Open Source For You
Over 40 CVEs have been disclosed against MCP implementations in 2026, and Microsoft confirmed poisoned MCP tool descriptions being used against fintech servers in the wild. The Hacker News Practical DevSecOps

Critical Vulnerabilities

CVE-2026-56164 - SharePoint Server Missing Authentication (ToolShell v2)

A missing-authentication flaw in on-premises SharePoint Server 2016, 2019, and Subscription Edition that lets an unauthenticated, network-adjacent attacker escalate privileges with no user interaction. Microsoft rated it CVSS 5.3 "Moderate," but the National Vulnerability Database independently scored it 9.8 Critical, a gap defenders should not let the vendor number talk them out of. It is under active exploitation and was added to CISA KEV with a July 17 federal deadline. Interim mitigation is enabling AMSI integration with Full Request Body Scan mode and prioritizing any internet-facing instance. SocPrime Penligent

CVE-2026-58644 - SharePoint Unauthenticated Deserialization RCE

An unauthenticated deserialization vulnerability in SharePoint Server carrying CVSS 9.8, chained with CVE-2026-56164 in the ToolShell v2 campaign to turn privilege escalation into full remote code execution. Added to the KEV catalog on July 16. Any organization still running on-prem SharePoint exposed to the internet should treat this chain as the top remediation priority. SideHustleBuilds Tenable

CVE-2026-56155 - Active Directory Federation Services EoP

An elevation-of-privilege zero-day in AD FS, CVSS 7.8, exploited in the wild. It starts from local low privilege, which makes it a post-foothold escalation tool rather than an initial-access vector, but AD FS sits at the center of federated single sign-on. A successful escalation here can undermine authentication trust for every relying-party application downstream. The federal patch deadline was today, July 28, 2026. Tenable How To Fix Guide

CVE-2026-55255 - Langflow Authorization Bypass (IDOR)

An Insecure Direct Object Reference in Langflow, the open-source AI agent and workflow builder, in the /api/v1/responses endpoint. The endpoint accepts a client-supplied flow identifier without verifying ownership, so an authenticated attacker can execute any other user's flow. Vendor-rated CVSS 9.9. Sysdig's Threat Research Team observed in-the-wild exploitation from June 25 aimed at code execution and second-stage implant delivery. All versions prior to 1.9.2 are affected; CISA set a July 10 remediation deadline. This is agentic AI infrastructure being used for real initial access. See the glossary on agentic red teaming for why AI orchestration tooling belongs inside your standard attack-surface program. BleepingComputer Threat Frontier Labs

CVE-2025-68686 - Fortinet FortiOS SSL-VPN Sensitive Information Exposure

A FortiOS SSL-VPN flaw exposing sensitive information, added to CISA KEV on July 27, 2026. SSL-VPN endpoints remain among the most reliably targeted edge assets because they are internet-facing by design and often lag on patching. Any FortiGate SSL-VPN deployment needs immediate exposure assessment. CISA Windows Forum

CVE-2026-16812 - Arista VeloCloud Orchestrator OS Command Injection

An OS command injection flaw in Arista VeloCloud Orchestrator, added to KEV alongside the Fortinet flaw on July 27. SD-WAN orchestrators sit at the network control plane, so command injection here can mean a pivot across every managed edge. CISA

CVE-2026-48282 - Adobe ColdFusion Path Traversal

A path traversal vulnerability in Adobe ColdFusion added to CISA KEV on July 7 based on active-exploitation evidence. ColdFusion continues its long run as a soft target in legacy enterprise stacks. CISA

CVE-2026-8932 - libcurl mTLS Connection Reuse Authentication Bypass

A 25-year-old flaw in libcurl where the library could reuse an existing connection even after client certificate or private key settings changed, enabling an authentication bypass. It affects applications built on libcurl but not the curl command-line tool. Given how deeply libcurl is embedded across software, this is a supply-chain-shaped exposure: the risk lives in your dependencies, not a single product you patch directly. SecurityWeek

AI Security Threats

The month made a case that AI security has moved past theory and into confirmed exploitation. The clearest signal is CVE-2026-55255 above: an AI workflow platform exploited in the wild for implant delivery, not a lab demonstration.

The broader posture data remains sobering. According to the Cisco State of AI Security 2026 report, 83% of organizations plan to deploy agentic AI, but only 29% feel ready to do so securely, a readiness gap that maps almost exactly to the Langflow event. Prompt injection, ranked LLM01 by OWASP, has surged 340% year over year and is described as the single fastest-growing category of cyberattack, with attack success rates between 50% and 84% depending on configuration and attempt count. No complete fix exists: even frontier models from Anthropic, OpenAI, and Google remain vulnerable after their best defenses are applied, so defense in depth is the only viable strategy. See the glossary entry on prompt injection for the mechanics. ECCU VentureBeat

Production coding assistants continue to accumulate high-severity CVEs, with reported flaws in Microsoft Copilot (CVSS 9.3), GitHub Copilot (CVSS 9.6), and Cursor IDE (CVSS 9.8), demonstrating that the injection surface reaches directly into developer workflows and the code that ships from them. Vectra AI

The Model Context Protocol ecosystem is where the agentic attack surface is expanding fastest. Over 40 CVEs have been disclosed against MCP implementations in 2026, with researchers estimating hundreds of thousands of exposed servers. Microsoft documented a poisoned-tool-description and description-injection pattern observed in the wild against fintech MCP servers, and academic work this month detailed Unicode TAG-block concealment of tool-metadata payloads that create an approval-view fidelity gap across three independent server implementations, meaning what a user approves is not what the agent actually runs. Named attack classes now include tool poisoning, rug pulls, tool shadowing, cross-server attacks, confused-deputy OAuth weaknesses, and the "lethal trifecta." The glossary on MCP security covers the trust-gap model behind these. The Hacker News Adversa AI

AI threat vector	Status	Evidence
Langflow IDOR (CVE-2026-55255)	Exploited in wild since June 25	BleepingComputer
MCP tool poisoning	In wild vs fintech servers	The Hacker News
Prompt injection (LLM01)	+340% YoY, no complete fix	ECCU
Coding-assistant CVEs	Copilot 9.3 / GitHub 9.6 / Cursor 9.8	Vectra AI
MCP implementation CVEs	40+ disclosed in 2026	Practical DevSecOps

Threat Actor Activity

Nation-state operations continue to fold LLMs into their tooling. Reporting indicates all four major nation-state blocs operationalized LLMs during 2025, and the 2026 benchmark for adversary breakout time, from initial foothold to active exfiltration, has compressed to 72 minutes. That number is the operational reality behind every patch deadline in this brief: once an actor lands via a flaw like the SharePoint chain, the window to detect and contain before data leaves is now measured in a single hour. Hive Security CloudSEK

Russian APT groups prioritized military, logistics, and energy sectors, pairing espionage with infrastructure-focused disruption, operating through three distinct entities with separate mandates: the SVR for intelligence collection, the GRU for military offensive operations, and the FSB for counterintelligence with an espionage function. DPRK and Iranian actors expanded credential-focused campaigns, financial theft, and targeted surveillance of policy and civil-society communities. Hive Security SecurityWeek

The through-line with the vulnerability picture: on-prem SharePoint and AD FS zero-days are exactly the kind of federated-authentication and collaboration infrastructure that intelligence-collection mandates target, because one foothold in an identity broker yields access far beyond a single host.

Ransomware and Data Breaches

The Anubis attack on Coca-Cola's Fairlife dairy subsidiary is the month's marquee incident and a clean example of the food-and-beverage sector's operational-technology exposure. Coca-Cola disclosed the attack in a July 16 Form 8-K; production at U.S. facilities was suspended. Anubis, a ransomware-as-a-service operation active since December 2024 that combines data theft with encryption, claimed it encrypted Nutanix infrastructure, reached Fairlife's environment through a third party, and threatened to leak 1TB of data with a July 27 deadline. The group listed the victim on its leak site July 20. Coca-Cola stated product quality and safety were not affected and Canadian operations continued. Fairlife is estimated at roughly $4 billion in annual sales. BleepingComputer GovInfoSecurity

Victim	Actor / vector	Impact	Source
Coca-Cola / Fairlife	Anubis RaaS, third-party access	Production halted, 1TB leak threatened, Nutanix encrypted	Cybersecurity Dive
Nintendo of America	Breach of third-party TinyPulse	Employee data exposed, $2M ransom demand	BreachSense
Nidec (Taiwan subsidiary)	BlackField group	Ransomware, alleged data theft at Nidec Chaun Choung	SWK Technologies
DHS	Network intrusion	Active intrusion into Homeland Security Information Network confirmed	BreachSense
Conduent (ongoing)	Prior breach, expanded scope	Affected population now exceeds 62.2 million individuals	BrightDefense

Two patterns stand out. First, third-party access is the common denominator across Fairlife, Nintendo, and Nidec: the initial door was a vendor or subsidiary environment, not the primary target's perimeter. Second, the Conduent breach expanding past 62.2 million individuals is a reminder that breach scope is rarely known at disclosure and tends to grow for months.

Recommended Actions

Immediate (this week)

Patch the SharePoint ToolShell v2 chain now: CVE-2026-56164 and CVE-2026-58644. If patching lags, enable AMSI Full Request Body Scan mode and take internet-facing SharePoint instances offline until remediated. SocPrime
Confirm CVE-2026-56155 is patched across all AD FS servers; the federal deadline was today. Review AD FS sign-in logs for anomalous local-privilege escalation. Tenable
Upgrade Langflow to 1.9.2 or later and audit the /api/v1/responses endpoint access logs for cross-user flow execution since June 25. Threat Frontier Labs
Assess exposure for FortiOS SSL-VPN (CVE-2025-68686) and Arista VeloCloud Orchestrator (CVE-2026-16812); both are freshly KEV-listed edge assets. CISA

Short-Term (this month)

Inventory every AI agent builder, MCP server, and LLM orchestration tool in the environment and bring them under the same asset-management, patch-SLA, and network-segmentation rules as production web infrastructure.
Audit MCP tool definitions for description-injection and Unicode-concealment payloads; verify that what an operator approves matches what the agent actually executes. Adversa AI
Rebuild third-party and subsidiary access on least-privilege and network isolation; the month's three biggest ransomware entries all pivoted through a vendor. Cybersecurity Dive
Inventory software built on libcurl and confirm mTLS connection-reuse handling against CVE-2026-8932. SecurityWeek

Strategic (this quarter)

Assume a 72-minute breakout window and measure your own detect-to-contain time against it; tune EDR and identity monitoring to alert inside that budget, not after it. Hive Security
Adopt defense-in-depth for AI systems on the premise that prompt injection has no complete fix: least-privilege agent tooling, output filtering, and human approval gates on any action with real-world effect. ECCU
Prepare for AI-accelerated vulnerability disclosure volume, exemplified by the Linux kernel's 432-CVE weekend, with risk-based patch prioritization rather than attempting to chase every advisory. Open Source For You
Treat on-prem collaboration and federated-identity infrastructure (SharePoint, AD FS) as high-value nation-state targets and prioritize their decommissioning or hardening accordingly.