Daily Threat Intelligence Brief - July 30, 2026

The Operator's Take

This week, the most damaging vulnerabilities are not in endpoints or web apps. They are in the consoles and orchestrators that sit above everything else. Arista VeloCloud Orchestrator, Check Point SmartConsole, Microsoft SharePoint, WordPress Core, and Langflow all landed on CISA’s Known Exploited Vulnerabilities catalog within days of each other, which means attackers are already moving from initial access to control-plane compromise at scale. The common thread: each of these tools is trusted by defenders, so a successful exploit often bypasses the normal layers of detection.

On the AI side, Langflow is now being treated the same way CISA treats a Citrix appliance or a FortiGate firewall, as production attack surface under active exploitation rather than a research curiosity. That shift matters because most organizations still run AI workflow platforms on internal networks with weak segmentation and little logging. At the same time, prompt injection and MCP tool poisoning are not following a normal vulnerability lifecycle; there is no patch that removes the risk, only controls that reduce it. The work this week is to patch the patchable, rotate the keys that outlive patches, and treat every agent tool registry as untrusted by default.

Executive Summary

CISA added eight entries to the Known Exploited Vulnerabilities catalog during the week of July 27, 2026, including network orchestrators, firewalls, collaboration platforms, WordPress Core, and an AI workflow framework.
Arista VeloCloud Orchestrator (CVE-2026-16812) carries a CVSS 10.0 score and an unauthenticated OS command injection flaw; the federal remediation deadline is July 30, 2026.
WordPress Core is under active attack through the wp2shell chain (CVE-2026-63030 and CVE-2026-60137), enabling unauthenticated remote code execution without any plugin.
Check Point SmartConsole (CVE-2026-16232) is being exploited as a zero-day to obtain full admin access through an authentication bypass using an application token.
Microsoft SharePoint Server (CVE-2026-50522) is actively exploited for unauthenticated deserialization RCE, and attackers are stealing ASP.NET machine keys to maintain persistence after patching.
Langflow has two separate KEV entries: CVE-2026-0770 for unauthenticated root RCE and CVE-2026-55255 for an authorization bypass that can leak AI provider keys.
libssh2 (CVE-2026-55200) has a critical client-side SSH RCE with a public PoC, exposing curl, Git, PHP, and any application that links the library.
Anubis ransomware claimed the Fairlife/Coca-Cola attack, disrupted U.S. dairy production, and threatened to leak roughly 1 TB of data.
Prompt injection attack volume reportedly rose about 340% in 2026, and MCP tool poisoning studies show success rates above 70% in controlled benchmarks.

Critical Vulnerabilities

CVE-2026-16812: Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator On-Prem contains an unauthenticated OS command injection vulnerability rated CVSS 10.0. A remote attacker can reach privileged internal functionality that was never intended to be externally exposed, potentially compromising the orchestrator and every SD-WAN device it manages. CISA added the flaw to KEV on July 27, 2026, with a federal remediation deadline of July 30, 2026. Affected branches include VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1. Arista has also published known attacker IP addresses for hunt teams: 8.19.75.217, 206.72.242.124, and 206.72.242.162.

Sources: Arista Security Advisory 0144, The Register, SecurityWeek, NVD

CVE-2026-63030 / CVE-2026-60137: WordPress Core wp2shell

WordPress Core is being chained through two flaws dubbed wp2shell. CVE-2026-63030 is a REST API batch-route confusion issue, and CVE-2026-60137 is a SQL injection in WP_Query::author__not_in. Together they allow unauthenticated remote code execution on a default WordPress install with no plugins required. Public PoCs are available, and multiple security firms report in-the-wild exploitation. Affected versions include WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1; administrators should upgrade to 6.9.5 or 7.0.2. WordPress 6.8.x is vulnerable to the SQLi portion only and should be patched to 6.8.6.

Sources: Triskele Labs, The Hacker News, NVD CVE-2026-63030

CVE-2026-16232: Check Point SmartConsole

Check Point Security Management Server and Multi-Domain Security Management Server are affected by an authentication bypass in the SmartConsole login process. An unauthenticated remote attacker can supply the management server’s own Secure Internal Communication distinguished name in a forged application certificate bind, obtain an application token, and log in to SmartConsole with full administrative privileges. The flaw is actively exploited as a zero-day and was added to CISA KEV on July 22, 2026, with a remediation deadline of July 25, 2026. Patches are delivered through Jumbo Hotfix Accumulators: R81.20 Take 158 or later, R82 Take 118 or later, and R82.10 Take 36 or later. Check Point has also released known attacker IP addresses for log hunting.

Sources: Check Point SK185169, Rapid7, BleepingComputer, NVD

CVE-2026-50522: Microsoft SharePoint Server

On-premises Microsoft SharePoint Server is affected by a deserialization of untrusted data vulnerability that leads to unauthenticated remote code execution as the IIS worker process. Microsoft released fixes on July 14, 2026, and a public PoC appeared around July 20. CISA added the flaw to KEV on July 22, 2026. Attackers are not only exploiting the RCE but also stealing ASP.NET/IIS machine keys, which can be used to maintain persistence even after the patch is applied. Fixed builds are 16.0.5561.1001 for SharePoint Server 2016, 16.0.10417.20175 for SharePoint Server 2019, and 16.0.19725.20434 for SharePoint Server Subscription Edition. Patching must be followed by machine-key rotation and compromise assessment.

Sources: The Hacker News, Microsoft MSRC, NVD

CVE-2026-55200: libssh2 Client-Side SSH RCE

libssh2 versions 1.11.1 and earlier contain an integer overflow in the SSH packet-handling code during the client-side handshake. A malicious SSH server can send a crafted packet_length value that wraps around, causing an out-of-bounds heap write and potentially remote code execution on the connecting client. Because the vulnerability is client-side, it affects anything that connects to an SSH server using libssh2, including curl with SCP/SFTP support, Git clients, the PHP ssh2 extension, backup tools, and CI/CD pipelines. Public PoCs are available, and simply updating the system package may not patch statically linked copies. Administrators should upgrade to libssh2 1.11.2 and inventory applications that embed the library.

Sources: Arctic Wolf, Rescana, SecPod, NVD

CVE-2026-0770: Langflow Unauthenticated Root RCE

Langflow, a visual builder for LLM workflows, contains an unauthenticated remote code execution flaw in the code validation endpoint POST /api/v1/validate/code. The application includes attacker-controlled Python functionality into the execution scope, allowing arbitrary code execution as root. CISA added CVE-2026-0770 to KEV on July 21, 2026, with a federal remediation deadline of July 24, 2026. Telemetry shows exploitation began on June 27, 2026, with reconnaissance, malware downloaders, and cloud-credential access observed in the wild. Organizations should upgrade to Langflow 1.10.1 or later, restrict network access to the validation endpoint, and rotate any cloud or API credentials accessible from Langflow hosts.

Sources: KEVIntel, NVD, Zero Day Initiative ZDI-26-036

CVE-2026-55255: Langflow Authorization Bypass

A separate Langflow flaw, CVE-2026-55255, allows an authenticated attacker to execute another user’s AI workflow by supplying a different flow ID to /api/v1/responses. Because ownership of the flow is not verified, the attacker can abuse workflows that contain embedded AI provider keys, cloud tokens, database credentials, and sensitive data. The flaw was added to CISA KEV on July 7, 2026, with a remediation deadline of July 10, 2026. Affected versions are prior to 1.9.1. In multi-tenant or shared environments, this is effectively a lateral-movement and secret-exfiltration path.

Sources: Qualys ThreatProtect, DeepInspect, NVD

AI Security Threats

Prompt Injection Remains the Top LLM Risk

OWASP continues to list prompt injection as LLM01:2025, the highest-priority risk for Large Language Model Applications. The UK National Cyber Security Centre warns that prompt injection is not like SQL injection; because LLMs process instructions and data in the same token stream, there is no clean architectural fix. Indirect prompt injection, where malicious instructions hide inside documents, emails, web pages, or retrieved content, is now the dominant form in production. One industry survey cited prompt injection in roughly 73% of production AI deployments assessed during security audits, with attack volume up about 340% in 2026.

Sources: OWASP LLM01 Prompt Injection, NCSC blog, ProofAgent

MCP Tool Poisoning and the Agent Supply Chain

The OWASP MCP Top 10 identifies MCP03:2025 Tool Poisoning and MCP06 Intent Flow Subversion as critical risks. Tool poisoning embeds malicious instructions inside an MCP server’s tool description, schema, or return values. Because the agent reads that metadata as trusted instructions, it can be tricked into exfiltrating data, invoking the wrong tool, or overriding user intent. Sub-techniques include schema poisoning, tool shadowing, and rug pulls. The CASCADE benchmark reported tool-poisoning attack success rates up to 72.8% across 20 LLM agents, and roughly 5.5% of public MCP servers showed tool-poisoning-style exposure in one 2026 analysis.

Sources: OWASP MCP Top 10, CASCADE arXiv, Cycode

Langflow and AI Workflow Platforms Become CISA-Level Attack Surface

Langflow’s presence on CISA KEV twice in one month signals a broader shift: AI agent orchestration platforms are now treated as production attack surface under active exploitation. CVE-2026-0770 gives unauthenticated root RCE, while CVE-2026-55255 gives authenticated users a path to other tenants’ workflows and secrets. A related GitHub Actions flaw, CVE-2026-33475, allows shell injection through user-controlled variables such as branch names and pull-request titles in Langflow’s CI/CD pipelines. FastGPT, another AI workflow project, also disclosed CVE-2026-50562 this month, a privilege escalation through workflow_run jobs that can push attacker-controlled containers to a Kubernetes cluster.

Sources: KEVIntel Langflow RCE, Qualys Langflow Auth Bypass, Cibersafety CVE-2026-33475, SentinelOne CVE-2026-50562

Practical Defenses for Agentic AI

Defenders should assume residual risk from prompt injection and treat every MCP security tool as untrusted until proven otherwise. Concrete steps include pinning or hashing tool descriptions on first approval, scanning tool schemas before loading, allow-listing approved MCP servers, sandboxing tool execution with least privilege, and requiring human approval for high-impact tool calls. For platforms like Langflow, restrict network access to the validate/code endpoint, disable multi-tenant sharing unless isolation is verified, and audit logs for unauthorized flow execution. Organizations building or deploying agents should add agentic red teaming to their release process, focusing on indirect injection via documents, emails, and tool outputs.

Sources: OWASP MCP03 Tool Poisoning, AppSentinels, NCSC guidance

Threat Actor Activity

Anubis ransomware claimed responsibility for the Fairlife attack and listed Coca-Cola on its leak site on July 20, 2026. The group uses double extortion and advertises a wiper mode that can permanently delete files. The attack encrypted Nutanix infrastructure and reportedly exfiltrated about 1 TB of data.
ShinyHunters claimed to have stolen internal documents, contracts, more than 22 million doctor-patient notes, over 20 million medical orders, and more than 1 million U.S. Social Security numbers from Abbott Laboratories. The group set a deadline of July 21, 2026, for a response before leaking data. Abbott stated the incident was limited to its Cancer Diagnostics business and that there was no known exposure of sensitive customer or business information.
ShadowByt3$ separately claimed access to Abbott’s LabCentral customer portal on July 4, 2026, using compromised customer credentials and a weak point, and exfiltrated technical documentation, manufacturing certificates, and regulatory documents.
Wallstreet ransomware emerged in early July 2026 with a Tor leak site listing victims across healthcare, insurance, automotive, and government sectors in the United States, Ecuador, and India.
State-aligned actors from China, Russia, and Iran accounted for 32% of notable activity updates in the first half of 2026, according to Forescout’s H1 threat review. The same report noted 37,137 newly published vulnerabilities, up 51% year over year, and 4,544 ransomware attack claims, up 25%.

Sources: SecurityWeek Fairlife, Help Net Security Fairlife, Malwarebytes Abbott, HIPAA Journal Abbott, LinkedIn RedPiranha Wallstreet, Intelligent CIO Forescout

Ransomware and Data Breaches

Ransomware Activity

Actor	Victim / Sector	Impact	Source
Anubis	fairlife LLC, Coca-Cola’s dairy subsidiary	Production halted at U.S. facilities; ~1 TB data stolen; breach confirmed July 28, 2026	SecurityWeek
Wallstreet	Healthcare, insurance, automotive, government	New leak site active; listings in U.S., Ecuador, India	LinkedIn RedPiranha

Data Breach Incidents

Victim	Claimed Data	Attributions / Status	Source
Abbott Laboratories Cancer Diagnostics	Internal documents, contracts, 22M+ doctor-patient notes, 20M+ medical orders, 1M+ SSNs	ShinyHunters claimed theft; Abbott investigating, says no known sensitive exposure	Malwarebytes
Abbott LabCentral portal	Technical docs, manufacturing certificates, regulatory documents	ShadowByt3$ claimed access via compromised credentials	HIPAA Journal

Recommended Actions

Immediate (this week)

Patch Arista VeloCloud Orchestrator to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 before the July 30, 2026 CISA deadline. Restrict VCO web access to trusted management networks and hunt for known attacker IPs.
Upgrade WordPress Core to 6.9.5, 7.0.2, or 6.8.6, then verify that automatic background updates actually applied.
Apply Check Point Jumbo Hotfix Accumulators (R81.20 Take 158+, R82 Take 118+, R82.10 Take 36+) and restrict Trusted Clients to trusted IP ranges.
Apply Microsoft’s July 2026 SharePoint updates, then rotate ASP.NET/IIS machine keys and hunt for web shells or child processes from w3wp.exe.
Upgrade Langflow to 1.10.1 or later and restrict access to /api/v1/validate/code and /api/v1/responses.
Upgrade libssh2 to 1.11.2 and inventory applications that statically link the library, including curl, Git, PHP, and backup tools.

Short-term (next 30 days)

Audit CI/CD pipelines for workflow_run triggers that consume untrusted pull-request artifacts, and avoid interpolating user-controlled values such as branch names or PR titles into shell commands.
Segment AI workflow platforms and agent orchestrators from production networks and sensitive data; treat them as high-value targets.
Scan for and restrict outbound SSH from build servers, developer workstations, and IoT devices until libssh2 linkage is verified.
Review SmartConsole and SharePoint audit logs for authentication events using the known attacker IP ranges published by Check Point and Microsoft.
Implement allow-listing and pinning for MCP servers and tool descriptions; scan tool schemas before loading them into agents.

Strategic

Adopt a default-deny posture for agent tool registries. Treat tool descriptions, schemas, and outputs as untrusted input, not configuration.
Build agentic red teaming into the AI release cycle, with a focus on indirect prompt injection and tool-poisoning scenarios.
Accept that prompt injection may never be fully eliminated; design controls around impact reduction, least privilege, human-in-the-loop approvals, and non-LLM safeguards for high-risk actions.
Maintain SBOMs and provenance records for AI frameworks, agent runtimes, and CI/CD scanners to shorten response time when the next supply-chain flaw appears.